Azure / Azure/azure-powershell

Start-AzPolicyRemediation (Az.PolicyInsights v1.6.5) Parameter PolicyDefinitionReferenceId Does Not Resolve ResourceId

Open
#25,588 0 comments 0 reactions 0 assignees View on GitHub
bug customer-reported
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

Hi, this issue could be one or all of the following: a lack of documentation, a bug, a lack of the property "ReferenceId" being in a neither a Policy Definition's JSON nor the Microsoft.Azure.PowerShell.Cmdlets.Policy.Models.PolicyDefinition object returned via PowerShell's Get-AzPolicyDefinition.

I have been struggling to create a Remediation Task from a Policy within an Initiative Assignment all morning, each time it would immediately go into "Succeeded" status and the result would be 0 of 0 resources remediated.

I finally tried via UI to deploy this remediation task, and it worked without issue. I compared the API calls made from PS and my browser and found that the issue was PolicyDefinitionReferenceId does not work with a resource ID being passed. Maybe if you work solely in the UI this is intuitive because you may see the "Reference ID" column when poking around in the _Initiatve Definition_. The frustrating part is that going directly to a Policy Definition, there is no Reference ID in the JSON for the Policy Definition. My reason for thinking it expected a ResourceId is because when looking at the definition using Get-AzPolicyDefinition the only Id in the properties is Id which is the ResourceId (/providers/Microsoft.Authorization/policyDefinitions/)

I compared the API call sent via UI and found that the ReferenceId was totally different from the ResourceId:
"policyDefinitionReferenceId": "deployAzureMonitorAgentLinuxHybridVM"

I also found the API call from the UI seems to go to a batch endpoint which has all the information for another API call to get relayed to the endpoint from batch, but when used in PowerShell the call goes direct so the overall call is different (method: POST instead of PUT, body much smaller as it only has the policy information vs the api call information, etc). Here is the total Body of the HTTP POST API Call from the UI to https://management.azure.com/batch to be clear:

```
{
"requests": [
{
"content": {
"id": "/providers/microsoft.management/managementgroups/it_managed/providers/microsoft.policyinsights/remediations/",
"name": "",
"properties": {
"policyAssignmentId": "/providers/microsoft.management/managementgroups//providers/microsoft.authorization/policyassignments/",
"policyDefinitionReferenceId": "deployAzureMonitorAgentLinuxHybridVM",
"filters": {
"locations": []
},
"resourceDiscoveryMode": "ExistingNonCompliant",
"resourceCount": 500,
"parallelDeployments": 10,
"failureThreshold": {
"percentage": 1
}
}
},
"httpMethod": "PUT",
"name": "",
"requestHeaderDetails": {
"commandName": "Microsoft_Azure_Policy.RemediationData/upsertRemediationTask"
},
"url": "/providers/microsoft.management/managementgroups//providers/microsoft.policyinsights/remediations/f?api-version=2021-10-01"
}
]
}
```


I think one or all of the following should happen:
1) documentation should be updated to call this out
2) resourceId of a PolicyDefinition should be resolvable to the ReferenceId on the back-end and acceptable input
3) ReferenceId should be returned with Get-AzPolicyDefinition
4) ReferenceId should be defined in the Policy Definition's JSON in the UI
5) If there ReferenceId passed doesnt exist, maybe...the API/cmdlet should return a 404 error message?

### Issue script & Debug output

```PowerShell
$Policy = Get-AzPolicyAssignment -Id "/providers/microsoft.management/managementgroups/it_managed/providers/microsoft.authorization/policyassignments/"
$PolicyDefinition = Get-AzPolicyDefinition -Id "/providers/microsoft.authorization/policydefinitions/"

Start-AzPolicyRemediation -PolicyAssignmentId $Policy.Id `
-Name "$($Policy.Name)_$($(Get-Date).ToString)" `
-PolicyDefinitionReferenceId $PolicyDefinition.Id `
-ManagementGroupName ""

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PUT

Absolute Uri:
https://management.azure.com//providers/Microsoft.Management/managementGroups//providers/Microsoft.PolicyInsights/remediations/?api-version=2021-1
0-01

Headers:
accept-language : en-US

Body:
{
"properties": {
"policyAssignmentId": "/providers/Microsoft.Management/managementGroups//providers/Microsoft.Authorization/policyAssignments/",
"policyDefinitionReferenceId": "/providers/Microsoft.Authorization/policyDefinitions/",
"parallelDeployments": 30
}
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Created

Body:
{
"properties": {
"policyAssignmentId": "/providers/microsoft.management/managementgroups//providers/microsoft.authorization/policyassignments/",
"policyDefinitionReferenceId": "/providers/microsoft.authorization/policydefinitions/",
"provisioningState": "Succeeded",
"createdOn": "2024-07-18T14:44:47.6432811Z",
"lastUpdatedOn": "2024-07-18T14:44:47.6434535Z",
"deploymentStatus": {
"totalDeployments": 0,
"successfulDeployments": 0,
"failedDeployments": 0
},
"resourceDiscoveryMode": "ExistingNonCompliant",
"correlationId": "",
"parallelDeployments": 30
},
"id": "/providers/microsoft.management/managementgroups//providers/microsoft.policyinsights/remediations/",
"name": "",
"type": "Microsoft.PolicyInsights/remediations",
"systemData": {
"createdBy": "",
"createdByType": "User",
"createdAt": "2024-07-18T14:44:45.3952982Z",
"lastModifiedBy": "",
"lastModifiedByType": "User",
"lastModifiedAt": "2024-07-18T14:44:45.3952982Z"
}
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 5.1.19041.4648
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.19041.4648
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```

### Module versions

```PowerShell
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 3.0.2 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault...}
Script 1.6.5 Az.PolicyInsights {Get-AzPolicyAttestation, Get-AzPolicyEvent, Get-AzPolicyMetadata, Get-AzPolicyRemediation...}
```

### Error output

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the Start-AzPolicyRemediation and Get-AzPolicyDefinition entry points, then compare the PowerShell request body with the Azure portal batch request shown here. Determine how PolicyDefinitionReferenceId is expected to relate to the policy assignment and definition; done should mean the accepted identifier and invalid-input behavior are clearly documented or consistently handled.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
api, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.