如何用CLI导出管理组范围内计划中的Azure策略？

你的需求完全可以实现，原代码仅获取了顶层的策略/计划分配记录，要导出计划内包含的策略，需要额外查询计划定义并展开其中的策略项。以下是修改后的PowerShell脚本：

# 定义目标管理组前缀
$targetMgScopePrefix = "/providers/Microsoft.Management/managementGroups/MG-name"

# 初始化结果数组
$policyDetails = @()

# 获取目标管理组下的所有策略分配
Get-AzPolicyAssignment | Where-Object { $_.Properties.Scope -like "$targetMgScopePrefix*" } | ForEach-Object {
    $assignment = $_
    $assignmentProps = $assignment.Properties

    # 判断当前分配是单个策略还是计划（Initiative/Policy Set）
    if ($assignmentProps.PolicyDefinitionId -match "policySetDefinitions") {
        # 是计划，获取计划定义详情
        $policySetDef = Get-AzPolicySetDefinition -Id $assignmentProps.PolicyDefinitionId
        # 遍历计划内的每个策略
        foreach ($policy in $policySetDef.Properties.PolicyDefinitions) {
            # 获取策略定义的显示名称（如果需要）
            $policyDef = Get-AzPolicyDefinition -Id $policy.PolicyDefinitionId
            # 添加到结果数组
            $policyDetails += [PSCustomObject]@{
                AssignmentDisplayName = $assignmentProps.DisplayName
                AssignmentScope       = $assignmentProps.Scope
                Type                  = "计划内策略"
                PolicyDisplayName     = $policyDef.Properties.DisplayName
                PolicyDefinitionId    = $policy.PolicyDefinitionId
                PolicyReferenceId     = $policy.ReferenceId # 计划内策略的引用ID（可选）
            }
        }
    } else {
        # 是单个策略，直接添加信息
        $policyDef = Get-AzPolicyDefinition -Id $assignmentProps.PolicyDefinitionId
        $policyDetails += [PSCustomObject]@{
            AssignmentDisplayName = $assignmentProps.DisplayName
            AssignmentScope       = $assignmentProps.Scope
            Type                  = "单个策略"
            PolicyDisplayName     = $policyDef.Properties.DisplayName
            PolicyDefinitionId    = $assignmentProps.PolicyDefinitionId
            PolicyReferenceId     = $null
        }
    }
}

# 导出到CSV
$policyDetails | Export-Csv -Path "./policyAssignments_WithInitiatives.csv" -NoTypeInformation -Encoding UTF8

关键说明： #

• 脚本会区分单个策略分配和计划分配，对计划分配自动展开内部包含的所有策略
• 额外获取了策略的显示名称（比纯ID更直观），如果不需要可以去掉Get-AzPolicyDefinition的调用，直接用$policy.PolicyDefinitionId
• 保留了原分配的显示名称和范围，方便关联每个策略所属的分配
• 加入了Type字段，清晰区分是单个策略还是计划内的策略

如果不需要获取策略显示名称，也可以简化脚本，跳过Get-AzPolicyDefinition的调用，能提升执行速度：

# 简化版本（不获取策略显示名称）
$targetMgScopePrefix = "/providers/Microsoft.Management/managementGroups/MG-name"
$policyDetails = @()

Get-AzPolicyAssignment | Where-Object { $_.Properties.Scope -like "$targetMgScopePrefix*" } | ForEach-Object {
    $assignment = $_
    $assignmentProps = $assignment.Properties

    if ($assignmentProps.PolicyDefinitionId -match "policySetDefinitions") {
        $policySetDef = Get-AzPolicySetDefinition -Id $assignmentProps.PolicyDefinitionId
        foreach ($policy in $policySetDef.Properties.PolicyDefinitions) {
            $policyDetails += [PSCustomObject]@{
                AssignmentDisplayName = $assignmentProps.DisplayName
                AssignmentScope       = $assignmentProps.Scope
                Type                  = "计划内策略"
                PolicyDefinitionId    = $policy.PolicyDefinitionId
                PolicyReferenceId     = $policy.ReferenceId
            }
        }
    } else {
        $policyDetails += [PSCustomObject]@{
            AssignmentDisplayName = $assignmentProps.DisplayName
            AssignmentScope       = $assignmentProps.Scope
            Type                  = "单个策略"
            PolicyDefinitionId    = $assignmentProps.PolicyDefinitionId
            PolicyReferenceId     = $null
        }
    }
}

$policyDetails | Export-Csv -Path "./policyAssignments_Simple.csv" -NoTypeInformation -Encoding UTF8

内容的提问来源于stack exchange，提问作者user14945898