Scope issue with "Microsoft.Authorization/policyDefinitions"

[sergey-netdev]

Bicep version
Bicep CLI version 0.23.1 (b02de2d)

Describe the bug
I'm trying to deploy a custom policy definition to a specific management group using Azure CLI and getting this:

policy.bicep(4,74) : Error BCP135: Scope "resourceGroup" is not valid for this resource type. Permitted scopes: "tenant", "managementGroup", "subscription".

To Reproduce
Run az deployment mg create --name ${DeploymentName} --location $LOCATION --template-file $TEMPLATEFILE --management-group-id $MGEnvironmentId with TEMPLATEFILE like this:

param parPolicyName string		= 'RequireGeoReplication'
param parPolicyDisplayName string	= 'Require geo-replication for storage accounts.'

resource policy 'Microsoft.Authorization/policyDefinitions@2020-09-01' = {
  name: parPolicyName
  properties: {
    displayName: parPolicyDisplayName
    policyType: 'Custom'
    mode: 'Indexed'
    policyRule: {
      if: {
        allOf: [
          {
            field: 'type'
            equals: 'Microsoft.Storage/storageAccounts'
          }
          {
            not: {
              field: 'Microsoft.Storage/storageAccounts/geoReplicationLocations[*]'
              exists: true
            }
          }
        ]
      }
      then: {
        effect: 'Deny'
      }
    }
  }
}

Additional context
If I add scope like this:

resource policy 'Microsoft.Authorization/policyDefinitions@2020-09-01' = {
  name: parPolicyName
  scope: 'managementGroup'

I get

policy.bicep(6,10) : Error BCP036: The property "scope" expected a value of type "tenant" but the provided value is of type "'managementGroup'".

[alex-frankel]

You need to add the following line:

targetScope = 'managementGroup'

By default the targetScope of a bicep file is implicitly set to resourceGroup.

https://learn.microsoft.com/azure/azure-resource-manager/bicep/deploy-to-management-group?tabs=azure-cli

[sergey-netdev]

This is so misleading. Why do I have to duplicate the scope if I already specified it with az deployment mg create? Does that mean that if I want to deploy the same policy to a MG, a sub or a RG I need three copies of it with different targetScope = line?