Azure / Azure/azure-cli

[ARM] az policy definition version create fails with undocumented feature gate for custom definitions

Open
#33,890 1 comment 0 reactions 1 assignee Claimed by @isra-fel View on GitHub
ARM Azure CLI Team question
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Describe the bug

`az policy definition version create` cannot create a version for a custom policy definition in my AzureCloud subscription. The service says the feature is disabled in this environment.

This does not appear to be a CLI syntax, RBAC, scope, or API-version issue:

- Creating the root custom definition with `--version 1.0.0` succeeds.
- The caller is Owner.
- The failure is identical at subscription and management-group scope.
- Direct REST calls return the same error.
- The stable REST API documents `policyType: Custom`, but I cannot find a feature-registration or enrollment step.

### Related command

```bash
az policy definition create \
--name \
--display-name "Policy versioning repro" \
--rules policy-rules.json \
--version 1.0.0

az policy definition version create \
--name \
--version 1.1.0 \
--display-name "Policy versioning repro" \
--rules policy-rules.json
```

### Errors

```text
(InvalidPolicyDefinitionVersionRequest) Creating policy definition versions is currently disabled in this environment. Please contact support for any questions.
```

Updating the root definition from version `1.0.0` to `1.1.0` also fails:

```text
(InvalidVersionIdentifier) Changing the value of the 'version' property is not yet supported in this environment.
```

### Issue script & Debug output

The request reaches `Microsoft.Authorization/policyDefinitions/versions/write` and passes authorization. I also tested the REST endpoint with API versions from `2023-04-01` through `2026-01-01-preview`; all return the same service-side error. `az feature list` shows no relevant registration feature.

Subscription, tenant, and request identifiers are omitted from this public issue.

### Expected behavior

Please clarify how a customer subscription can use this command:

- If custom policy-definition versioning is generally available, what enables it in a subscription where it is currently disabled?
- If it is allowlisted or preview-only, what is the enrollment path?

The CLI help and REST documentation should state any rollout or enrollment requirement.

### Environment Summary

```text
azure-cli 2.89.1
core 2.89.1
azure-mgmt-resource 24.0.0
Python (Darwin) 3.14.6
Cloud AzureCloud
```

### Additional context

- REST API: https://learn.microsoft.com/en-us/rest/api/policy/policy-definition-versions/create-or-update?view=rest-policy-2025-11-01
- CLI PR adding the GA commands: https://github.com/Azure/azure-cli/pull/33416
- The CLI live-test recording successfully creates custom versions in a Microsoft test environment: https://github.com/Azure/azure-cli/blob/2dc0e0415ce83ca21e6d04ab26e038487881e0f8/src/azure-cli/azure/cli/command_modules/resource/tests/latest/recordings/test_resource_policy_version_default.yaml

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.