### Install Hydration Kit

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/start-hydration-kit.md

Use the `Install-HydrationEpac` cmdlet to start the Hydration Kit Installer. Specify the `TenantIntermediateRoot` for the installation.

```PowerShell
$tenantIntermediateRoot = "contoso" # Replace with your Management Group ID
Install-HydrationEpac -TenantIntermediateRoot $tenantIntermediateRoot
```

--------------------------------

### Example Global Settings Configuration

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/settings-global-setting-file.md

This example demonstrates the required elements for the `global-settings.jsonc` file, including `pacOwnerId` and `pacEnvironments` definitions.

```json
{
    "$schema": "https://raw.githubusercontent.com/Azure/enterprise-azure-policy-as-code/main/Schemas/global-settings-schema.json",
    "pacOwnerId": "00000000-0000-0000-0000-000000000000",
    "pacEnvironments": [
        {
            "pacSelector": "epac-dev",
            "cloud": "AzureCloud",
            "tenantId": "00000000-0000-0000-0000-000000000000",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/mg-Epac-Dev",
            "desiredState": {
                "strategy": "full",
                "keepDfcSecurityAssignments": false,
                "doNotDisableDeprecatedPolicies": false
            },
            "skipResourceValidationForExemptions": false,
            "managedIdentityLocation": "eastus2"
        },
        {
            "pacSelector": "tenant",
            "cloud": "AzureCloud",
            "tenantId": "00000000-0000-0000-0000-000000000000",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/mg-Enterprise",
            "desiredState": {
                "strategy": "full",
                "keepDfcSecurityAssignments": false,
                "doNotDisableDeprecatedPolicies": false
            },
            "skipResourceValidationForExemptions": false,
            "managedIdentityLocation": "eastus2",
            "globalNotScopes": [
                "/providers/Microsoft.Management/managementGroups/mg-Epac-Dev"
            ]
        }
    ]
}
```

--------------------------------

### High Contrast Theme Output Example

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Scripts/Helpers/THEME-README.md

This example shows the output with the 'high-contrast' theme, using text-based indicators and distinct background colors for accessibility.

```text
+------------------------+
|  Building Policy Plan  |
+------------------------+

>> Processing Policies
======================
[OK] 5 policies processed successfully    (white text on green background)
[WARN] 2 warnings found                  (black text on yellow background)
[ERROR] 1 error occurred                 (white text on red background)
```

--------------------------------

### Screen Reader Theme Output Example

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Scripts/Helpers/THEME-README.md

This example demonstrates the output for the 'screen-reader' theme, which uses plain text labels and no decorative characters for optimal screen reader compatibility.

```text
Building Policy Plan

SECTION: Processing Policies
SUCCESS: 5 policies processed successfully
WARNING: 2 warnings found
```

--------------------------------

### EPAC Default Theme Configuration Example

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/settings-output-themes.md

An example of a complete EPAC theme configuration, including definitions for header, section, and status characters and colors. This can be copied and customized.

```json
{
    "themeName": "default",
    "themes": {
        "default": {
            "name": "Default Modern Theme",
            "description": "Standard colorful theme with Unicode characters",
            "characters": {
                "header": {
                    "topLeft": "┏",
                    "topRight": "┓",
                    "bottomLeft": "┗",
                    "bottomRight": "┛",
                    "horizontal": "━",
                    "vertical": "┃"
                },
                "section": {
                    "arrow": "▶",
                    "underline": "━"
                },
                "status": {
                    "success": "✓",
                    "warning": "⚠",
                    "error": "✗",
                    "info": "•",
                    "skip": "⊘",
                    "update": "⭮",
                    "processing": "🔄"
                }
            },
            "colors": {
                "header": {
                    "primary": "Cyan",
                    "secondary": "DarkCyan"
                },
                "section": "Blue",
                "status": {
                    "success": "Green",
                    "warning": "Yellow",
                    "error": "Red",
                    "info": "White",
                    "skip": "DarkGray",
                    "update": "Cyan",
                    "processing": "Yellow"
                }
            }
        }
    }
}
```

--------------------------------

### PAC Configuration Example

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/guidance-lighthouse.md

This snippet shows a configuration for a Policy as Code deployment, specifying the strategy and deployment details. Ensure 'full' strategy is used for comprehensive policy application.

```json
{
                "strategy": "full",
                "keepDfcSecurityAssignments": false
            },
            "deployedBy": "My Org Admins"
        }
```

--------------------------------

### Screen Reader Theme Output Example

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/settings-output-themes.md

Example of the output generated when the 'screen-reader' theme is active. This output is designed for clarity and compatibility with text-to-speech software.

```text
Building Policy Plan

SECTION: Processing Policies
SUCCESS: 5 policies processed successfully
WARNING: 2 warnings found
ERROR: 1 error occurred
```

--------------------------------

### EPAC Target Subscription Configuration Example

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/guidance-lighthouse.md

Example configuration for a target subscription within EPAC. Ensure 'tenantId' points to your tenant, and 'deploymentRootScope' and 'managedTenantId' are set for the customer's subscription and tenant.

```json
        {
            "pacSelector": "epac-ManagedCustomerSubscription1",
            "cloud": "AzureCloud",
            "tenantId": "00000000-1111-2222-3333-444444444444",                                <----My Tenant
            "deploymentRootScope": "/subscriptions/999999-8888-7777-6666-555555555555",        <----Customer subscription
            "managedTenantId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",                         <----Customer tenant ID
            "desiredState": {

```

--------------------------------

### New-EpacGlobalSettings

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/operational-scripts-reference.md

Creates a global-settings.jsonc file with a new GUID, managed identity location, and tenant information.

```APIDOC
## New-EpacGlobalSettings

### Description
Creates a global-settings.jsonc file with a new GUID, managed identity location and tenant information.

### Parameters
- **-ManagedIdentityLocation** (String) - Required - The Azure location to store the managed identities.
- **-TenantId** (String) - Required - The Azure tenant id.
- **-DefinitionsRootFolder** (String) - Required - The folder path to where the New-EpacDefinitionsFolder command created the definitions root folder.
- **-DeploymentRootScope** (String) - Required - The root management group to export definitions and assignments.
```

--------------------------------

### Lighthouse Managed Tenant Configuration Example

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/settings-global-setting-file.md

This JSON configuration demonstrates how to set up policy assignments for a Lighthouse Managed Tenant, including specifying tenant IDs, deployment scopes, desired states, and global exclusions.

```json
{
    "pacOwnerId": "00000000-0000-0000-0000-000000000000",
    "pacEnvironments": [
        {
            "pacSelector": "epac-dev",
            "cloud": "AzureCloud",
            "tenantId": "11000000-0000-0000-0000-000000000000",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/PAC-Heinrich-Dev",
            "desiredState": {
                "strategy": "full",
                "keepDfcSecurityAssignments": false,
                "doNotDisableDeprecatedPolicies": false
            },
            "skipResourceValidationForExemptions": false,
            "mangedIdentityLocation": "eastus2"
        },
        {
            "pacSelector": "tenant",
            "cloud": "AzureCloud",
            "tenantId": "11000000-0000-0000-0000-000000000000",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/Contoso-Root",
            "desiredState": {
                "strategy": "full",
                "keepDfcSecurityAssignments": false,
                "doNotDisableDeprecatedPolicies": false
            },
            "globalNotScopes": [
                "/providers/Microsoft.Management/managementGroups/PAC-Heinrich-Dev"
            ],
            "skipResourceValidationForExemptions": false,
            "managedIdentityLocation": "eastus2"
        },
        {
            "pacSelector": "lightHouseTenant",
            "cloud": "AzureCloud",
            "tenantId": "11000000-0000-0000-0000-000000000000",
            "managedTenantId": "22000000-0000-0000-0000-000000000000",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/Contoso-Root",
            "desiredState": {
                "strategy": "full",
                "keepDfcSecurityAssignments": false,
                "doNotDisableDeprecatedPolicies": false
            },
            "skipResourceValidationForExemptions": false,
            "managedIdentityLocation": "eastus2"
        }
    ]
}
```

--------------------------------

### Example Expiration Date Update

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/guidance-exemptions.md

An example of how to update the 'expiresOn' field with a new timestamp in the required format.

```text
"2025-01-01T01:00:00Z"
```

--------------------------------

### Default Theme Output Example

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Scripts/Helpers/THEME-README.md

This is an example of the output generated using the default EPAC theme, which includes colorful Unicode characters and box drawing for headers.

```text
┏━━━━━━━━━━━━━━━━━━━━━━━━┓
┃  Building Policy Plan  ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━┛

▶ Processing Policies
━━━━━━━━━━━━━━━━━━━━━
✓ 5 policies processed successfully
⚠ 2 warnings found
```

--------------------------------

### Example Policy Assignment ID

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/guidance-exemptions.md

This is an example of a full policy assignment path used to identify specific policies for exemption.

```json
"policyAssignmentId": "/providers/Microsoft.Management/managementGroups/[ManagementGroupName]/providers/Microsoft.Authorization/policyAssignments/[PolicyAssignmentName]"
```

--------------------------------

### Switching to High Contrast Theme

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/settings-output-themes.md

Modify the `themeName` in your `.epac/theme.json` file to switch to the 'high-contrast' theme. This example shows the structure for defining multiple themes.

```json
{
    "themeName": "high-contrast",
    "themes": {
        "default": { /* ... */ },
        "high-contrast": { /* ... */ },
        "screen-reader": { /* ... */ }
    }
}
```

--------------------------------

### Azure DevOps Pipeline for Policy Documentation

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/operational-scripts-documenting-policy.md

An example Azure DevOps pipeline step to execute the policy documentation script using a Service Principal. This requires a Service Connection configured with the Service Principal.

```yaml
steps:
    - task: AzurePowerShell@5
        displayName: Build policy documentation → ADO Wiki via SPN
        inputs:
            azureSubscription: $(ServiceConnectionName)   # SPN-based service connection
            ScriptPath: Scripts/Operations/Build-PolicyDocumentation.ps1
            ScriptArguments: -PacSelector <your pac selector> -WikiSPN
            azurePowerShellVersion: LatestVersion
```

--------------------------------

### Get-AzPolicyAliasOutputCSV

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/operational-scripts-reference.md

Gets all policy aliases and outputs them to a CSV file.

```APIDOC
## Get-AzPolicyAliasOutputCSV

### Description
Gets all aliases and outputs them to a CSV file.
```

--------------------------------

### Simple Policy Assignment Example (Allowed Locations)

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/policy-assignments.md

This JSON defines a simple policy assignment for 'Allowed Locations'. It includes details for the policy definition, assignment properties, parameters, and deployment scope. Ensure assignments have a `displayName` when managing Azure Virtual Network Manager policies.

```json
{
  "nodeName": "/root",
  "definitionEntry": {
    "displayName": "Allowed Locations Initiative",
    "policySetName": "general-allowed-locations-policy-set"
  },
  "assignment": {
    "name": "allowed-locations",
    "displayName": "Allowed Locations",
    "description": "Sets the allowed locations"
  },
  "metadata": {},
  "enforcementMode": "Default",
  "parameters": {
    "AllowedLocations": [
      "centralus",
      "eastus",
      "eastus2",
      "southcentralus"
    ]
  },
  "scope": {
    "epac-dev": [
      "/providers/Microsoft.Management/managementGroups/Epac-Mg-1"
    ],
    "tenant": [
      "/providers/Microsoft.Management/managementGroups/c"
    ]
  }
}
```

--------------------------------

### New-PipelineFromStarterKit

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/operational-scripts-reference.md

Copies pipelines and templates from the starter kit to a new folder, assembling workflows based on specified configuration parameters.

```APIDOC
## New-PipelineFromStarterKit

### Description
This script copies pipelines and templates from the starter kit to a new folder. The script assembles the pipelines/workflows based on the type of pipeline to create, the branching flow to implement, and the type of script to use.

### Parameters
- **StarterKitFolder** (String) - Optional - Starter kit folder
- **PipelinesFolder** (String) - Optional - New pipeline folder
- **PipelineType** (String) - Optional - Type of DevOps pipeline to create AzureDevOps or GitHubActions?
- **BranchingFlow** (String) - Optional - Implementing branching flow Release or GitHub
- **ScriptType** (String) - Optional - Using Powershell module or script?
```

--------------------------------

### Initialize Pipelines with New-PipelineFromStarterKit

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/operational-scripts-reference.md

Copies and assembles pipelines and templates from the starter kit into a new directory based on specified configuration parameters.

```ps1
New-PipelineFromStarterKit [[-StarterKitFolder] <String>] [[-PipelinesFolder] <String>] [[-PipelineType] <String>] [[-BranchingFlow] <String>] [[-ScriptType] <String>] [<CommonParameters>]
```

--------------------------------

### Build Deployment Plans using Module

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/ci-cd-overview.md

Use the `Build-DeploymentPlans` cmdlet from the EnterprisePolicyAsCode module to analyze policy changes and create deployment plans. This is the recommended method for building plans.

```powershell
Build-DeploymentPlans
```

--------------------------------

### Create GitHub Workflows from Starter Kit

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/ci-cd-overview.md

Use these commands to generate GitHub Workflows from the starter kit. Specify the starter kit folder, pipelines folder, pipeline type, branching flow, and script type.

```powershell
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\.github/workflows -PipelineType GitHubActions -BranchingFlow GitHub -ScriptType script
```

```powershell
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\.github/workflows -PipelineType GitHubActions -BranchingFlow Release -ScriptType script
```

```powershell
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\.github/workflows -PipelineType GitHubActions -BranchingFlow GitHub -ScriptType module
```

```powershell
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\.github/workflows -PipelineType GitHubActions -BranchingFlow Release -ScriptType module
```

--------------------------------

### Download EPAC StarterKit for Local Script Execution

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/start-hydration-kit.md

This is an optional step required only if using local scripts for deployment instead of the EnterprisePolicyAsCode module. It downloads the EPAC StarterKit from GitHub.

```powershell
$null = New-Item -ItemType Directory -Path ./temp
git clone https://github.com/Azure/enterprise-azure-policy-as-code.git ./temp
Copy-Item ./temp/Scripts ./ -Recurse -Force
Remove-Item ./temp -Recurse -Force
```

--------------------------------

### Deploy Policies using Module

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/ci-cd-overview.md

Use the `Deploy-PolicyPlan` cmdlet from the EnterprisePolicyAsCode module to deploy policies, policy sets, assignments, and exemptions based on the generated plan. This is the recommended deployment method.

```powershell
Deploy-PolicyPlan
```

--------------------------------

### Create Azure DevOps Pipelines from Starter Kit

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/ci-cd-overview.md

Use these commands to generate Azure DevOps Pipelines from the starter kit. Specify the starter kit folder, pipelines folder, pipeline type, branching flow, and script type.

```powershell
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\pipelines -PipelineType AzureDevOps -BranchingFlow GitHub -ScriptType script
```

```powershell
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\pipelines -PipelineType AzureDevOps -BranchingFlow Release -ScriptType script
```

```powershell
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\pipelines -PipelineType AzureDevOps -BranchingFlow GitHub -ScriptType module
```

```powershell
New-PipelinesFromStarterKit -StarterKitFolder .\StarterKit -PipelinesFolder .\pipelines -PipelineType AzureDevOps -BranchingFlow Release -ScriptType module
```

--------------------------------

### Policy Exemption Folder Structure

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/policy-exemptions.md

Example of the required directory structure for organizing exemption definition files.

```text
Definitions
  policyExemptions
    epac-dev
      <name>.csv of <name>.json
    tenant
      <name>.csv of <name>.json
```

--------------------------------

### Build-PolicyDocumentation Script Syntax

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/operational-scripts-reference.md

Generates documentation from policy definitions. Defaults to './Definitions' and './Outputs' if paths are not specified.

```ps1
Build-PolicyDocumentation [[-DefinitionsRootFolder] <String>] [[-OutputFolder] <String>] [-WindowsNewLineCells] [-Interactive <Boolean>] [-SuppressConfirmation] [-IncludeManualPolicies] [<CommonParameters>]
```

--------------------------------

### Example Expiration Timestamp Format

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/guidance-exemptions.md

Specifies the required format for the 'expiresOn' field when setting an expiration date for a policy exemption.

```text
"YYYY-MM-DDTmm:hh:ssZ"
```

--------------------------------

### New-HydrationDefinitionsFolder

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/operational-scripts-reference.md

Creates a definitions folder with the correct folder structure and a blank global settings file.

```APIDOC
## New-HydrationDefinitionsFolder

### Description
Creates a definitions folder with the correct folder structure and blank global settings file.

### Parameters
- **-DefinitionsRootFolder** (String) - Optional - The folder path to create the definitions root folder (default: ./Definitions)
```

--------------------------------

### Modify Default Enforcement Mode

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/integrating-with-alz-library.md

Example of how to modify the default enforcement mode within the generated policy structure file. Options are 'Default' or 'DoNotEnforce'.

```json
"enforcementMode": "Default" // Can be Default or DoNotEnforce
```

--------------------------------

### Initiate Remediation with Start-AzPolicyRemediation

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/guidance-remediation.md

Use the Start-AzPolicyRemediation cmdlet to incrementally update the environment to reach the desired security posture. Review and update Effect parameters as needed.

```powershell
Start-AzPolicyRemediation
```

--------------------------------

### EPAC Implementation Path Decision Tree

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/start-implementing.md

A decision tree to guide users on choosing between the Hydration Kit and Manual Configuration based on their needs and experience with EPAC.

```text
Are you new to EPAC? → YES → Use the Hydration Kit (recommended)
                     ↓
Do you need advanced customization? → NO → Use the Hydration Kit
                                   ↓
Do you have complex multi-tenant requirements? → YES → Manual Configuration
                                              ↓
                                             NO → Use the Hydration Kit
```

--------------------------------

### Build Deployment Plans using Script

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/ci-cd-overview.md

Execute the `Build-DeploymentPlans.ps1` script directly to build deployment plans. This is an alternative to using the PowerShell module.

```powershell
Build-DeploymentPlans.ps1
```

--------------------------------

### Create Hydration Definitions Folder

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/operational-scripts-reference.md

Initializes the required folder structure and a blank global settings file.

```ps1
New-HydrationsDefinitionFolder [[-DefinitionsRootFolder] <String>] [<CommonParameters>]
```

--------------------------------

### EPAC High Contrast Theme Configuration Example

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/settings-output-themes.md

Configuration snippet for the 'high-contrast' theme in EPAC. This theme uses text-based indicators and background colors for better visibility.

```json
{
    "themeName": "high-contrast",
    "themes": { /* ... */ }
}
```

--------------------------------

### Update Policy Parameter Value

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/integrating-with-alz-library.md

Example of how to update a parameter value within the generated policy structure file. Locate the specific parameter and modify its 'value' field.

```json
"ama_vm_insights_data_collection_rule_id": {
  "policy_assignment_name": [
    "Deploy-VM-Monitoring",
    "Deploy-VMSS-Monitoring",
    "Deploy-vmHybr-Monitoring"
  ],
  "description": "The data collection rule id that should be used for the VM Insights deployment.",
  "parameters": {
    "parameter_name": "dcrResourceId",
    "value": "" // Update the value here as required by the description
  }
}
```

--------------------------------

### Generate Assignments with Guardrails

Source: https://github.com/azure/enterprise-azure-policy-as-code/blob/main/Docs/integrating-with-alz-library.md

Example PowerShell command to generate assignments with guardrails included. By default, guardrail assignments are placed into the corresponding management groups (platform and landing_zones archetypes).

```powershell

```