Protection Policy
Manage the policies that protect resources.
List protection policies
Returns the protection policies. Without options it returns every policy, whatever its deleted or disabled status; set isDeleted or isDisabled to true to return only deleted or only disabled policies.
Create a protection policy
Creates a protection policy with its resources, resource groups and protected groups, and schedules protection for its resources. Resource and resource group identifiers that do not exist are skipped. Returns the new policy.
Copy a protection policy
Creates a new protection policy as a copy of an existing one and schedules protection for it. The copy is named after the original with ' Copy' added (then ' Copy (2)' and so on if that name is taken). Returns the new policy.
Update the protected groups of a policy
Replaces the protected groups and their members in a policy with those in the request, adding and removing groups and members as needed. Returns the updated policy.
List protection policy names and identifiers
Returns the name and identifier of every protection policy, sorted by name, for use in pickers and lookups. Deleted and disabled policies are included.
List policies that cover a resource
Returns the protection policies that apply to a resource. Policies that contain the resource directly are returned only when they are not deleted or disabled. By default the result also includes policies that reach the resource through a resource group, whatever their status; set directOnly to true to leave those out.
Update the contents of a protection policy
Replaces a policy's settings, protected groups, resources and resource groups with those in the request, then reschedules protection. New resources that do not exist, have no host, or are Entra ID tenants are skipped. Returns an object holding the updated policy and the number of resources added.
Search protection policies
Returns a page of protection policies, optionally limited to those that contain a given resource directly and filtered by text. Deleted and disabled policies are included. Use skip and take to page and orderBy to sort.
Search resources and groups to add to a policy
Returns a page of resources, resource groups or secret vaults on Windows or Linux platforms that can be added to a protection policy. Use entityType to choose what to search for; when a policy is given, resources already directly in that policy are left out, but resource groups already in it are still listed.
Delete a protection policy
Permanently deletes a protection policy and stops scheduled protection for its resources that no other policy covers. The call does not return a body. To mark a policy deleted without removing it, use the status route instead.
Get a protection policy
Returns one protection policy, including its resource, resource group and protected group assignments. The policy is returned whatever its deleted or disabled status.
Update a protection policy name and description
Changes the name and description of a protection policy. Other fields in the body are ignored. Returns the updated policy.
List resources in a protection policy
Returns the resources that are directly in a protection policy.
Add resources to a protection policy
Adds resources to a protection policy and reschedules protection. Resources that do not exist or have no host are skipped, and Entra ID tenants are not added. Returns the policy.
Remove a resource from a protection policy
Removes one resource from a protection policy and reschedules protection for the affected resources. Returns the updated policy.
List resource groups in a protection policy
Returns the resource groups that are in a protection policy.
Add a resource group to a protection policy
Adds a resource group to a protection policy and reschedules protection. To see the result, read the policy again afterward.
Remove a resource group from a protection policy
Removes one resource group from a protection policy and reschedules protection for the affected resources. The call does not return a body.
Disable, enable, delete or restore a policy
Sets whether a protection policy is deleted or disabled and reschedules protection. Send only the options to change. Returns the updated policy.