Azure / Azure/azure-powershell

Set-AzPolicyAssignment Command Loses Description and Display Name

Open
#25,362 4 comments 0 reactions 0 assignees View on GitHub
bug customer-reported Policy Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

While testing the Set-AzPolicyAssignment command with the latest version, we noticed the following behavior:

Policy Enforcement Mode and Non-Compliant Messages: These properties are maintained correctly when running the command.

Description and Display Name: These properties are lost when executing the command directly.

### Issue script & Debug output

```PowerShell
# Connect to Azure
Note: Policy assignment is set to DoNotEnforce, for testing.

Get-AzPolicyAssignment -Id "/subscriptions//providers/Microsoft.Authorization/policyAssignments/"

# Set the subscription context
Set-AzContext -SubscriptionId ""

# Assign a policy with the Set-AzPolicyAssignment command
Set-AzPolicyAssignment -Id "/subscriptions//providers/Microsoft.Authorization/policyAssignments/" -EnforcementMode Default
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 7.4.2
PSEdition Core
GitCommitId 7.4.2
OS Microsoft Windows 10.0.22635
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
Get-InstalledModule -Name Az -AllVersions

Version Name Repository Description
------- ---- ---------- -----------
12.0.0 Az PSGallery Microsoft Azure PowerShell - Cmdlets to manage resources in Azure. This module is compatib…

Get-InstalledModule -Name Az.Resources -AllVersions

Version Name Repository Description
------- ---- ---------- -----------
7.1.0 Az.Resources PS
```

### Error output

```PowerShell
Example Output Before Changing Enforcement Mode:

Metadata : @{parameterScopes=; createdBy=; createdOn=5/27/2024 7:36:55 PM; updatedBy=; updatedOn=6/24/2024 6:17:53 PM}
NonComplianceMessage :
NotScope :
Parameter : @{profileName=}
Description : This is a test
DisplayName : DiagOpenAI
EnforcementMode : DoNotEnforce
Id : /subscriptions//providers/Microsoft.Authorization/policyAssignments/
IdentityPrincipalId :
IdentityTenantId :
IdentityType :
IdentityUserAssignedIdentity : Microsoft.Azure.PowerShell.Cmdlets.Policy.Models.IdentityUserAssignedIdentities
Location :
Name :
Override : {}
PolicyDefinitionId : /subscriptions//providers/Microsoft.Authorization/policyDefinitions/
ResourceSelector : {}
SystemDataCreatedAt : 5/27/2024 7:36:55 PM
SystemDataCreatedByType : User
SystemDataLastModifiedAt : 6/24/2024 6:17:53 PM
SystemDataLastModifiedByType : User
Type : Microsoft.Authorization/policyAssignments

Example Output After Changing Enforcement Mode:

Metadata : @{createdBy=; createdOn=5/27/2024 7:36:55 PM; updatedBy=; updatedOn=6/24/2024 6:43:50 PM}
NonComplianceMessage :
NotScope :
Parameter : @{profileName=}
Description :
DisplayName :
EnforcementMode : Default
Id : /subscriptions//providers/Microsoft.Authorization/policyAssignments/
IdentityPrincipalId :
IdentityTenantId :
IdentityType :
IdentityUserAssignedIdentity : Microsoft.Azure.PowerShell.Cmdlets.Policy.Models.IdentityUserAssignedIdentities
Location :
Name :
Override :
PolicyDefinitionId : /subscriptions//providers/Microsoft.Authorization/policyDefinitions/
ResourceSelector :
SystemDataCreatedAt : 5/27/2024 7:36:55 PM
SystemDataCreatedByType : User
SystemDataLastModifiedAt : 6/24/2024 6:43:50 PM
SystemDataLastModifiedByType : User
Type : Microsoft.Authorization/policyAssignments

Example of workaround:

Piping the output of Get to the Set:

Get-AzPolicyAssignment -Id "/subscriptions//providers/Microsoft.Authorization/policyAssignments/" | Set-AzPolicyAssignment

Nonetheless, documentation does not state this, so it could be somewhat confusing.
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the reported behavior with Get-AzPolicyAssignment and Set-AzPolicyAssignment in Az.Resources 7.1.0, using the enforcement-mode command shown. Compare the direct Set result with the pipeline workaround; done means changing EnforcementMode preserves Description and DisplayName, with regression coverage or documentation explaining the supported behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
cloud, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.