我需要从政策计划中创建政策分配并进行补救。我可以使用以下命令来创建分配。
$newRgAssignment = New-AzPolicyAssignment -Name $assigName -PolicySetDefinition $policySet -PolicyParameterObject $Params -AssignIdentity -Location 'westus' -scope $rgscope -DisplayName $assigName
在此，我可以成功创建作业。在尝试在Azure Portal中手动进行修复时，我可以在Azure门户中看到以下错误消息。
The managed identity for this assignment does not have the appropriate permissions to remediate these resources. To add these permissions, go to the Edit Assignment page for this Policy and re-save it.
我尝试通过传递系统设定的身份类型来创建策略分配，但遇到了相同的问题。
我只剩下一个选项，该选项是用户签名的身份类型。要传递此参数，我们需要获得分配的用户身份。为了获得用户身份，我使用了以下命令
Set-AzContext -Subscription 'XYZ-123-ABC'
$UserAssignedIdentity = Get-AzUserAssignedIdentity
，但没有用。
任何人都可以帮助我在这个问题上吗？任何帮助都可以应用。
谢谢。
I have a requirement of creating policy assignment from policy initiative and do remediation. I can create assignment using the below command.
$newRgAssignment = New-AzPolicyAssignment -Name $assigName -PolicySetDefinition $policySet -PolicyParameterObject $Params -AssignIdentity -Location 'westus' -scope $rgscope -DisplayName $assigName
In this I can create assignment successfully. while trying to remediation manually in I can see the below error message in azure portal .
The managed identity for this assignment does not have the appropriate permissions to remediate these resources. To add these permissions, go to the Edit Assignment page for this Policy and re-save it.
I tried creating a policy assignment by passing SystemAssigned identity type but ran into same problem.
I have left with only one option that is UserAssigned identity type. To pass this parameter we need to get the assigned user identity . To get the user identity I used the below commands
Set-AzContext -Subscription 'XYZ-123-ABC'
$UserAssignedIdentity = Get-AzUserAssignedIdentity
But no use.
Can any one help me on this issue. Any help can be appriciated.
Thank you.
发布评论
评论（1）
安装模块
az.managedSericeSidentity后，我们尝试使用以下CMD尝试，并能够获得结果。警告您可能会收到，但在
set-azcontext -subscription'xyz-123-abc'之后它将登录您想要的正确订阅。
成功登录类型
$ userAssignedIdentity，即使您在该订阅中具有用户角色。有关更多信息，请参阅以下链接： -
ms doc | get-azuserAssignedIdentity
SO Thread 。
We have tried with below cmd after installing module
Az.ManagedSericeIdentityand can able to get the results.Warning you might receive but after
Set-AzContext -Subscription 'XYZ-123-ABC'it will be logged into the correct subscription you wanted to.
After successfully login type
$UserAssignedIdentityeven if you have user role to that subscription.For more information please refer the below links:-
MS DOC|
Get-AzUserAssignedIdentitySO THREAD .