Azure Policy Remediation with Deployment Scripts

Thanks Anthony, your post is really helpful.

I am trying to make sure any new subscriptions have a Azure provider and feature enabled and it doesn't look like regular ARM template can do it. 

After some struggle this code worked for me :

    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Resources/subscriptions"
          }
        ]
      },
      "then": {
        "effect": "DeployIfNotExists",
        "details": {
          "type": "Microsoft.Resources/deployments",
          "name": "SQLVMREG",
          "ExistenceScope": "subscription",
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
          ],
          "deploymentScope": "subscription",
          "deployment": {
            "location": "westus2",
            "name": "SQLVMREG",

I used a named deployment so it won't rerun on the subscriptions which already did it.