Azure / Azure/azure-powershell

Not possible to update policyDefinitionReferenceId with New- or Update-AzPolicySetDefinition

Open
#25,112 2 comments 1 reaction 1 assignee Claimed by @VeryEarly View on GitHub
bug customer-reported
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

I want to update my policyDefinitionReferenceIds in my policy initiative definition [definitions.json](https://github.com/user-attachments/files/15685698/definitions.json).

I am using a policy initiative definition file:
[networkdef.json](https://github.com/user-attachments/files/15685700/networkdef.json)
and a parameter file:
[networkparam.json](https://github.com/user-attachments/files/15685701/networkparam.json)
These 2 files are how I created the policy initiative definition. However, the policyDefinitionReferenceIds is being overwritten by the system and automatically generated. You can see that result in the first file ([definitions.json](https://github.com/user-attachments/files/15685698/definitions.json))

To create the definition, I use this command:

```
$metadata = ConvertTo-Json @{ version = "1.0.0"; category = "Network" }

New-AzPolicySetDefinition `
-Name 'Enforce-Guardrails-Network' `
-DisplayName 'Enforce recommended guardrails for Network and Networking services' `
-PolicyDefinition C:\temp\networkdef.json `
-Parameter C:\Temp\networkparam.json `
-ManagementGroupName 'MG-ID' `
-Description 'This policy initiative is a group of policies that ensures Network and Networking services are compliant per regulated Landing Zones.' `
-Metadata $metadata
```

The above code, should have created the policyDefinitionReferenceIds for me. However, it is ignored as I said.

When I then try to update them again, I get the same result regardless if I use `Update-AzPolicySetDefinition` or `New-AzPolicySetDefinition`.
`New-AzPolicySetDefinition -Name 'Enforce-Guardrails-Network' -PolicyDefinition .\definitions.json -Parameter .\networkparam.json`
or
`Update-AzPolicySetDefinition -Name 'Enforce-Guardrails-Network' -PolicyDefinition .\definitions.json -Parameter .\networkparam.json`

**Output**:
```
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
"policyDefinitionReferenceId": "15299596690223791311",
"groupNames": []
}
```

**Expected Output**
```
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
"policyDefinitionReferenceId": "Deny-Nsg-GW-subnet",
"groupNames": [],
}
```

**When running the $DebugPreference it is clear that the property policyDefinitionReferenceId is not part of the properties available**

### Issue script & Debug output

```PowerShell
"policyDefinitions": [
{
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
"groupNames": []
},
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 7.4.2
PSEdition Core
GitCommitId 7.4.2
OS Microsoft Windows 10.0.22631
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 3.0.0 Az.Accounts {Add-AzEnvironment, Clear-AzCon…
Script 7.1.0 Az.Resources {Export-AzResourceGroup, Export…
```

### Error output

```PowerShell
No errors. See above message.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.