Trigger Azure Policy to evaluate compliance

Can now be done with either Azure CLI

az policy state trigger-scan --resource-group !!!resource-group-name!!!

Or powershell

Start-AzPolicyComplianceScan -ResourceGroupName !!!resource-group-name!!!

Old school with API rest call

$subscriptionId = "!!!SUBSCRIPTION ID!!!"

$uri = "$subscriptionId/providers/Microsoft.PolicyInsights/policyStates/latest/triggerEvaluation?api-version=2018-07-01-preview"
$azContext = Get-AzContext
$azProfile = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile
$profileClient = New-Object -TypeName Microsoft.Azure.Commands.ResourceManager.Common.RMProfileClient -ArgumentList ($azProfile)
$token = $profileClient.AcquireAccessToken($azContext.Tenant.Id)
$authHeader = @{
    'Authorization'='Bearer ' + $token.AccessToken
Invoke-RestMethod -Method Post -Uri $uri -UseBasicParsing -Headers $authHeader

Azure custom policy: Approved Costcenter Tag Values

Json for the rule. The tag could be something else. Just change the field: “tags.Costcenter”

  "mode": "All",
  "policyRule": {
    "if": {
      "not": {
        "field": "tags.Costcenter",
        "in": "[parameters('allowedTagValues')]"
    "then": {
      "effect": "deny"
  "parameters": {
    "allowedTagValues": {
      "type": "Array",
      "metadata": {
        "displayName": "Allowed tag values",
        "description": "The list of allowed Costcenter tag values"

Parameters when assigning the policy