{
  "$schema": "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
      "targetMG": {
          "type": "string",
          "metadata": {
              "description": "Target Management Group"
          }
      },
      "policyDefinitionID": {
        "type": "string",
        "metadata": {
          "description": "Specifies the ID of the policy definition or policy set definition being assigned."
        }
      }
  },
  "variables": {
      "mgScope": "[tenantResourceId('Microsoft.Management/managementGroups', parameters('targetMG'))]",
      "policyDefinitionName": "VMsWithoutManagedDisks"
  },
  "resources": [
      {
          "type": "Microsoft.Authorization/policyAssignments",
          "name": "[variables('policyDefinitionName')]",
          "apiVersion": "2019-09-01",
          "properties": {
              "scope": "[variables('mgScope')]",
              "policyDefinitionId": "[parameters('policyDefinitionID')]"
          }
      }
  ]
}