title: How to reference Azure policy set parameters in policy rule correctly?
body: <p>I have following policy rule. Finally it should check existence of a resourcegroup on subscription level. If it does not exist, a remediation task deployment should be started. I would like to pass parameters to this rule.</p>
  <pre><code>{
      &quot;if&quot;: {
          &quot;field&quot;: &quot;type&quot;,
          &quot;equals&quot;: &quot;Microsoft.Resources/subscriptions&quot;
      },
      &quot;then&quot;: {
          &quot;effect&quot;: &quot;DeployIfNotExists&quot;,
          &quot;details&quot;: {
              &quot;type&quot;: &quot;Microsoft.Resources/subscriptions/resourceGroups&quot;,
              &quot;name&quot;: &quot;my_resource_group&quot;,
              &quot;roleDefinitionIds&quot;: [
                  &quot;/providers/Microsoft.Authorization/roleDefinitions/{builtinroleGUID}&quot;
              ],
              &quot;existenceScope&quot;: &quot;Subscription&quot;,
              &quot;existenceCondition&quot;: {
                  &quot;allOf&quot;: [
                      {
                          &quot;field&quot;: &quot;type&quot;,
                          &quot;equals&quot;: &quot;Microsoft.Resources/subscriptions/resourceGroups&quot;
                      },
                      {
                          &quot;field&quot;: &quot;name&quot;,
                          &quot;equals&quot;: &quot;parameters('resourceGroup')&quot;
                      }
                  ]
              },
              &quot;deploymentScope&quot;: &quot;Subscription&quot;,
              &quot;deployment&quot;: {
                  &quot;location&quot;: &quot;westeurope&quot;,
                  &quot;properties&quot;: {
                      &quot;mode&quot;: &quot;incremental&quot;,
                      &quot;parameters&quot;: {
                          &quot;targetResourceGroup&quot;: {
                              &quot;value&quot;: &quot;[parameters('resourceGroup')]&quot;
                          },
                          &quot;ascWorkflowName&quot;: {
                              &quot;value&quot;: &quot;[parameters('securityAutomationWorkflowName')]&quot;
                          },
                          &quot;location&quot;: {
                              &quot;value&quot;: &quot;[parameters('location')]&quot;
                          },
                          &quot;logicAppName&quot;: {
                              &quot;value&quot;: &quot;[parameters('logicAppName')]&quot;
                          },
                          &quot;logicAppSubscription&quot;: {
                              &quot;value&quot;: &quot;[parameters('logicAppSubscription')]&quot;
                          }
                      },
                      &quot;template&quot;: {
                          &quot;$schema&quot;: &quot;https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#&quot;,
                          &quot;contentVersion&quot;: &quot;1.0.0.0&quot;,
                          &quot;parameters&quot;: {
                              &quot;targetResourceGroup&quot;: {
                                  &quot;type&quot;: &quot;string&quot;
                              },
                              &quot;ascWorkflowName&quot;: {
                                  &quot;type&quot;: &quot;string&quot;
                              },
                              &quot;location&quot;: {
                                  &quot;type&quot;: &quot;string&quot;,
                                  &quot;defaultValue&quot;: &quot;westeurope&quot;
                              },
                              &quot;logicAppName&quot;: {
                                  &quot;type&quot;: &quot;string&quot;
                              },
                              &quot;logicAppSubscription&quot;: {
                                  &quot;type&quot;: &quot;string&quot;
                              }
                          },
                          &quot;variables&quot;: {
                              &quot;logicAppName&quot;: &quot;[parameters('logicAppName')]&quot;,
                              &quot;logicAppTriggerName&quot;: &quot;When_an_Azure_Security_Center_Recommendation_is_created_or_triggered&quot;,
                              &quot;logicAppResourceId&quot;: &quot;[concat('/subscriptions/', parameters('logicAppSubscription'), '/resourceGroups/', parameters('targetResourceGroup') , '/providers/Microsoft.Logic/workflows/', variables('logicAppName'))]&quot;,
                              &quot;ascWorkflowTriggerId&quot;: &quot;[concat('/subscriptions/', parameters('logicAppSubscription'),  '/resourceGroups/', parameters('targetResourceGroup') , '/providers/Microsoft.Logic/workflows/', variables('logicAppName') ,'/triggers/',  variables('logicAppTriggerName'))]&quot;
                          },
                          &quot;resources&quot;: [
                              {
                                  &quot;apiVersion&quot;: &quot;2019-01-01-preview&quot;,
                                  &quot;name&quot;: &quot;[parameters('ascWorkflowName')]&quot;,
                                  &quot;type&quot;: &quot;Microsoft.Security/automations&quot;,
                                  &quot;location&quot;: &quot;westeurope&quot;,
                                  &quot;tags&quot;: {},
                                  &quot;properties&quot;: {
                                      &quot;description&quot;: &quot;Workflow to push security center recommendations to our logicApp that routes it to serviceNow&quot;,
                                      &quot;isEnabled&quot;: true,
                                      &quot;scopes&quot;: [
                                          {
                                              &quot;description&quot;: &quot;[concat('scope for current subscriptionId:', subscription().subscriptionId)]&quot;,
                                              &quot;scopePath&quot;: &quot;[concat('/subscriptions/',subscription().subscriptionId)]&quot;
                                          }
                                      ],
                                      &quot;sources&quot;: [
                                          {
                                              &quot;eventSource&quot;: &quot;Assessments&quot;,
                                              &quot;ruleSets&quot;: [
                                                  {
                                                      &quot;rules&quot;: [
                                                          {
                                                              &quot;propertyJPath&quot;: &quot;type&quot;,
                                                              &quot;propertyType&quot;: &quot;String&quot;,
                                                              &quot;expectedValue&quot;: &quot;Microsoft.Security/assessments&quot;,
                                                              &quot;operator&quot;: &quot;Contains&quot;
                                                          }
                                                      ]
                                                  }
                                              ]
                                          }
                                      ],
                                      &quot;actions&quot;: [
                                          {
                                              &quot;logicAppResourceId&quot;: &quot;[variables('logicAppResourceId')]&quot;,
                                              &quot;actionType&quot;: &quot;LogicApp&quot;,
                                              &quot;uri&quot;: &quot;[listCallbackUrl(variables('ascWorkflowTriggerId'), '2016-06-01').value]&quot;
                                          }
                                      ]
                                  }
                              }
                          ]
                      }
                  }
              }
          }
      }
  }
  </code></pre>
  <p>With this setup I would expect that the resourceGroup parameter reference links to the parameter of the parent policy-set /initiative.
  But what I get is an error using the azure-cli in powershell. Why do I get the error?</p>
  <pre><code>
  function ConvertTo-PolicyJson {
      param (
          [PSCustomObject] $inputObject
      )
      # See this issue with convertto-json array serialization problem - 
      # https://stackoverflow.com/questions/20848507/why-does-powershell-give-different-result-in-one-liner-than-two-liner-when-conve/38212718#38212718
      # Remove the redundant ETS-supplied .Count property
      $removed = Remove-TypeData System.Array -erroraction 'silentlycontinue'
      $json = ConvertTo-Json $inputObject  -Depth 10
      return $json.replace('&quot;', '\&quot;').replace(&quot;`n&quot;,&quot;&quot;).replace(&quot;`r&quot;,&quot;&quot; )
  }
  
  ...
  
  $policyRuleParametersJson = ConvertTo-PolicyJson @{
      &quot;resourceGroup&quot;                  = @{
          &quot;type&quot;         = &quot;String&quot;
          &quot;defaultValue&quot; = &quot;$ResourceGroup&quot;
          &quot;metadata&quot;     = @{
              &quot;description&quot; = &quot;The resource group where the resources are located in&quot;
              &quot;displayName&quot; = &quot;Resource group&quot;
              &quot;strongType&quot;  = &quot;existingResourceGroups&quot;
          }
      }}
  
  ...
  
  
  $policySetJson = ConvertTo-PolicyJson @(
      @{
          &quot;policyDefinitionId&quot; = &quot;/subscriptions/$Subscription/providers/Microsoft.Authorization/policyDefinitions/$ResourceGroupExistsPolicyName&quot;
          &quot;parameters&quot; = @{
              &quot;resourceGroup&quot; = @{ 
                  &quot;value&quot; = &quot;my_resource_group&quot; 
              }  }
  ...
  
  
  $policyDefinitionSetCreateResult = az policy set-definition create `
      --subscription $Subscription `
      --definitions $policySetJson `
      --params $policyRuleParametersJson `
      --name $PolicySetName `
      --description $PolicySetDescription `
      --display-name $PolicySetDisplayName 
  
  
  
  </code></pre>
  <p>The error I am getting is:</p>
  <pre><code>The policy set 'my-policy-set' has defined parameters 'resourceGroup' which are not used in referenced policy definitions. Please either remove these parameters from the definition or ensure that they are used.
  </code></pre>
  <p>But I have used the resourceGroup parameter as far as I know.
  By the way I condensed the error example to one parameter (resourceGroup). Finally I would like to use more parameters.</p>
  <p>Can somebody help please?</p>