There is a command group 'az_policy_definition'. This group of commands could 'manage resource policy definitions'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_policy_definition_create'.The syntax is: az policy definition create --name
                            [--description]
                            [--display-name]
                            [--management-group]
                            [--mode]
                            [--params]
                            [--rules]
                            [--subscription]. The 1th example of the child command would be to use it to 'create a read only policy', the syntax is: az policy definition create --name readOnlyStorage --rules "{ \"if\": \
    { \"field\": \"type\", \"equals\": \"Microsoft.Storage/storageAccounts/write\" }, \
        \"then\": { \"effect\": \"deny\" } }". The 2th example of the child command would be to use it to 'create a policy parameter definition', the syntax is: az policy definition create --name allowedLocations \
    --rules "{ \"if\": { \"allOf\": [ \
        { \"field\": \"location\",\"notIn\": \"[parameters('listOfAllowedLocations')]\" }, \
            { \"field\": \"location\", \"notEquals\": \"global\" }, \
                { \"field\": \"type\", \"notEquals\": \
                    \"Microsoft.AzureActiveDirectory/b2cDirectories\"} \
                        ] }, \"then\": { \"effect\": \"deny\" } }" \
    --params "{ \"allowedLocations\": { \
        \"type\": \"array\", \"metadata\": { \"description\": \
            \"The list of locations that can be specified when deploying resources\", \
                \"strongType\": \"location\", \"displayName\": \"Allowed locations\" } } }". The 3th example of the child command would be to use it to 'create a read only policy that can be applied within a management group', the syntax is: az policy definition create -n readOnlyStorage --management-group "MyManagementGroup" \
    --rules "{ \"if\": { \"field\": \"type\", \
        \"equals\": \"Microsoft.Storage/storageAccounts/write\" }, \
            \"then\": { \"effect\": \"deny\" } }". The 4th example of the child command would be to use it to 'create a policy definition with mode  the mode  indexed  indicates the policy should be evaluated only for resource types that support tags and location', the syntax is: az policy definition create --name TagsPolicyDefinition --subscription "MySubscription" \
    --mode Indexed --rules "{ \"if\": { \"field\": \"tags\", \"exists\": \"false\" }, \
        \"then\": { \"effect\": \"deny\" } }". The parameter '--name -n' is required. It is used to name of the new policy definition.. The parameter '--description' is optional. description of policy definition.. The parameter '--display-name' is optional. display name of policy definition.. The parameter '--management-group' is optional. name of the management group the new policy definition can be assigned in.. The parameter '--mode -m' is optional. mode of the policy definition, e.g. all, indexed. please visit https://aka.ms/azure-policy-mode for more information.. The parameter '--params' is optional. json formatted string or a path to a file or uri with parameter definitions.. The parameter '--rules' is optional. policy rules in json format, or a path to a file containing json rules.. The parameter '--subscription' is optional. name or id of the subscription the new policy definition can be assigned in.. 