How to resolve policy set definition deletion errors caused by referenced assignments in azure management group

[mclgoerg]

I have a policy set definition at the root level with various child management groups using different parameters. When I try to run a deployment on EPAC_ORG_DEV, I get the following error:

The policy set definition 'Baseline-Definition' cannot be deleted. It is referenced by the policy assignment '/providers/Microsoft.Management/managementGroups/UK-Int/providers/Microsoft.Authorization/policyAssignments/...'. Please delete all policy assignments referencing the policy.

I understand why this error appears, but I’m not sure how to fix it. Essentially, I need to modify or remove the Baseline-Definition assignment so my deployment can proceed. How can I properly achieve this?

For reference, I’ve attached a simplified view of the management group structure and some examples from the assignment and global-settings.

Assignment.json

{
    "nodeName": "/Test/",
    "parameterFile": "baseline-parameters.csv",
    "definitionEntryList": [
        {
            "policySetName": "Baseline-Definition",
            "displayName": "[Org] Security Controls",
            "assignment": {
                "append": true,
                "name": "Org-Security",
                "displayName": "[Org] Security Controls",
                "description": "Org security baseline based on ..."
            }
        }
    ],
    "children": [
        {
            "nodeName": "DEV/",
            "assignment": {
                "name": "D-",
                "displayName": "[Dev]",
                "description": "[Dev] controls"
            },
            "parameterSelector": "DEV",
            "nonComplianceMessageColumn": "nonComplianceMessages",
            "scope": {
                "EPAC_ORG_DEV": [
                    "/providers/Microsoft.Management/managementGroups/US-Dev",
                    "/providers/Microsoft.Management/managementGroups/UK-Dev"
                ]
            }
        },
       {
            "nodeName": "INT/",
            "assignment": {
                "name": "I-",
                "displayName": "[Int]",
                "description": "[Int] controls"
            },
            "parameterSelector": "INT",
            "nonComplianceMessageColumn": "nonComplianceMessages",
            "scope": {
                "EPAC_ORG_INT": [
                    "/providers/Microsoft.Management/managementGroups/US-Int",
                    "/providers/Microsoft.Management/managementGroups/UK-Int"
                ]
            }
        }
        ...
    ]
}

global-settings.jsonc

{
     "pacEnvironments": [
           {
            "pacSelector": "EPAC_ORG_DEV",
            "cloud": "AzureCloud",
            "tenantId": "...",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/root",
            "desiredState": { 
                "strategy": "ownedOnly",
                "keepDfcSecurityAssignments": true,
                "doNotDisableDeprecatedPolicies": true
            },
            "globalNotScopes": [
                "/providers/Microsoft.Management/managementGroups/US-Int",
                "/providers/Microsoft.Management/managementGroups/UK-Int",
                "/providers/Microsoft.Management/managementGroups/US-Prod",
                "/providers/Microsoft.Management/managementGroups/UK-Prod"          
            ],
            "managedIdentityLocation": "...",
            "deployedBy": "..."
        },
        {
            "pacSelector": "EPAC_ORG_INT",
            "cloud": "AzureCloud",
            "tenantId": "...",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/root",
            "desiredState": { 
                "strategy": "ownedOnly",
                "keepDfcSecurityAssignments": true,
                "doNotDisableDeprecatedPolicies": true
            },
            "globalNotScopes": [ 
                "/providers/Microsoft.Management/managementGroups/US-Dev",     
                "/providers/Microsoft.Management/managementGroups/UK-Dev",
                "/providers/Microsoft.Management/managementGroups/US-Prod",
                "/providers/Microsoft.Management/managementGroups/UK-Prod"                               
            ],
            "managedIdentityLocation": "...",
            "deployedBy": "..."
        }
     ]
}