Azure / Azure/azure-powershell
Not possible to update policyDefinitionReferenceId with New- or Update-AzPolicySetDefinition
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 54
Description
### Description
I want to update my policyDefinitionReferenceIds in my policy initiative definition [definitions.json](https://github.com/user-attachments/files/15685698/definitions.json).
I am using a policy initiative definition file:
[networkdef.json](https://github.com/user-attachments/files/15685700/networkdef.json)
and a parameter file:
[networkparam.json](https://github.com/user-attachments/files/15685701/networkparam.json)
These 2 files are how I created the policy initiative definition. However, the policyDefinitionReferenceIds is being overwritten by the system and automatically generated. You can see that result in the first file ([definitions.json](https://github.com/user-attachments/files/15685698/definitions.json))
To create the definition, I use this command:
```
$metadata = ConvertTo-Json @{ version = "1.0.0"; category = "Network" }
New-AzPolicySetDefinition `
-Name 'Enforce-Guardrails-Network' `
-DisplayName 'Enforce recommended guardrails for Network and Networking services' `
-PolicyDefinition C:\temp\networkdef.json `
-Parameter C:\Temp\networkparam.json `
-ManagementGroupName 'MG-ID' `
-Description 'This policy initiative is a group of policies that ensures Network and Networking services are compliant per regulated Landing Zones.' `
-Metadata $metadata
```
The above code, should have created the policyDefinitionReferenceIds for me. However, it is ignored as I said.
When I then try to update them again, I get the same result regardless if I use `Update-AzPolicySetDefinition` or `New-AzPolicySetDefinition`.
`New-AzPolicySetDefinition -Name 'Enforce-Guardrails-Network' -PolicyDefinition .\definitions.json -Parameter .\networkparam.json`
or
`Update-AzPolicySetDefinition -Name 'Enforce-Guardrails-Network' -PolicyDefinition .\definitions.json -Parameter .\networkparam.json`
**Output**:
```
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
"policyDefinitionReferenceId": "15299596690223791311",
"groupNames": []
}
```
**Expected Output**
```
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
"policyDefinitionReferenceId": "Deny-Nsg-GW-subnet",
"groupNames": [],
}
```
**When running the $DebugPreference it is clear that the property policyDefinitionReferenceId is not part of the properties available**
### Issue script & Debug output
```PowerShell
"policyDefinitions": [
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
"groupNames": []
},
```
### Environment data
```PowerShell
Name Value
---- -----
PSVersion 7.4.2
PSEdition Core
GitCommitId 7.4.2
OS Microsoft Windows 10.0.22631
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```
### Module versions
```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 3.0.0 Az.Accounts {Add-AzEnvironment, Clear-AzCon…
Script 7.1.0 Az.Resources {Export-AzResourceGroup, Export…
```
### Error output
```PowerShell
No errors. See above message.
```
Contributor guide
Assessment
This issue has not been assessed yet.