[ARM] az policy definition version create fails with undocumented feature gate for custom definitions
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
### Describe the bug
`az policy definition version create` cannot create a version for a custom policy definition in my AzureCloud subscription. The service says the feature is disabled in this environment.
This does not appear to be a CLI syntax, RBAC, scope, or API-version issue:
- Creating the root custom definition with `--version 1.0.0` succeeds.
- The caller is Owner.
- The failure is identical at subscription and management-group scope.
- Direct REST calls return the same error.
- The stable REST API documents `policyType: Custom`, but I cannot find a feature-registration or enrollment step.
### Related command
```bash
az policy definition create \
--name \
--display-name "Policy versioning repro" \
--rules policy-rules.json \
--version 1.0.0
az policy definition version create \
--name \
--version 1.1.0 \
--display-name "Policy versioning repro" \
--rules policy-rules.json
```
### Errors
```text
(InvalidPolicyDefinitionVersionRequest) Creating policy definition versions is currently disabled in this environment. Please contact support for any questions.
```
Updating the root definition from version `1.0.0` to `1.1.0` also fails:
```text
(InvalidVersionIdentifier) Changing the value of the 'version' property is not yet supported in this environment.
```
### Issue script & Debug output
The request reaches `Microsoft.Authorization/policyDefinitions/versions/write` and passes authorization. I also tested the REST endpoint with API versions from `2023-04-01` through `2026-01-01-preview`; all return the same service-side error. `az feature list` shows no relevant registration feature.
Subscription, tenant, and request identifiers are omitted from this public issue.
### Expected behavior
Please clarify how a customer subscription can use this command:
- If custom policy-definition versioning is generally available, what enables it in a subscription where it is currently disabled?
- If it is allowlisted or preview-only, what is the enrollment path?
The CLI help and REST documentation should state any rollout or enrollment requirement.
### Environment Summary
```text
azure-cli 2.89.1
core 2.89.1
azure-mgmt-resource 24.0.0
Python (Darwin) 3.14.6
Cloud AzureCloud
```
### Additional context
- REST API: https://learn.microsoft.com/en-us/rest/api/policy/policy-definition-versions/create-or-update?view=rest-policy-2025-11-01
- CLI PR adding the GA commands: https://github.com/Azure/azure-cli/pull/33416
- The CLI live-test recording successfully creates custom versions in a Microsoft test environment: https://github.com/Azure/azure-cli/blob/2dc0e0415ce83ca21e6d04ab26e038487881e0f8/src/azure-cli/azure/cli/command_modules/resource/tests/latest/recordings/test_resource_policy_version_default.yaml
Contributor guide
Assessment
This issue has not been assessed yet.