Azure / Azure/azure-powershell

Get-AzPolicyDefinition - Migration Help for Az 12.0.0, it appears the policy id is under a section call “id” and not “PolicyDefinitionID”

Open
#26,190 1 comment 0 reactions 0 assignees View on GitHub
bug customer-reported needs-triage
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

I've a customer needing assistance in reconfiguring their PowerShell scripts for their environment as their PowerShell cmdlet formats are out of date per guidelines of our documentation:
[Migration guide for Az 12.0.0 | Microsoft Learn](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fpowershell%2Fazure%2Fmigrate-az-12.0.0%3Fview%3Dazps-12.3.0&data=05%7C02%7Cwangalex%40microsoft.com%7Ced736a2e201a448e1f4708dcde708671%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638629822159730469%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=JIABHbhJZUXX8%2B0y3V%2FIZuK0fA1myKTCECBBaujdTYM%3D&reserved=0)

ISSUE: ADO pipeline to deploy/create new Policy Initiatives to be assigned at tenant level scope “16b9c567-9b8b-4112-a115-xxx” is failing with PowerShell script error:

"The referenced policyDefinitionID
| '/providers/Microsoft.Management/managementGroups/16b9c567-9b8b-4112-a115-cfecbxxxx/providers/Microsoft.Authorization/policyDefinitions/RBACAzureKubernetespolicy' doesn't exist at the specified scope"


TROUBLESHOOTING: A collection of debug logs were taken over the course of 2 weeks, implementing Verbose statement to output the variable “$existingPolicyDefintions” that was linked to the Az cmdlet Get-AzPolicyDefinition that was being executed in the "Set-InitiativeDefinitions" PS script withing the pipeline to pull the list of policy definitions defined at the tenant level scope, at first there was conflict in pulling the proper output of the ids from the var as for a couple instances it's ouput in the debug was found empty or the id would have an additional quotation mark appended at the end. Either of these outputs in comparison to the id that it should equal within the if condition of the script would result in failure and script termination.

It was finally determined debugging at the source of where the $existingPolicyDefinitions" was created that when trying to retrieve the ids of the policies at tenant ($existingPolicyDefinitions | select PolicyDefinitionID) fetching property “PolicyDefinitionID” the results were null, indicating the property being fetched does not exists within the configuration of the policy definition resource output.

After separate testing with the Get-AzPolicyDefinition cmdlet to see what output looks like for the proeprties of a policy definition, it appears the policy id is under a section call “id” and not “PolicyDefinitionID”. Once it was tested to switch out every instance of implementations of fetching the PolicyDefinitionID property to “id” from the var $existingPolicyDefinitions, the output of getting the proper policy ids was successful eliminating the specified error.

SOLUTION: The PS script for the ADO deployment is configured to use the latest version of AzPowerShell and recently in the beginning of September, there were updates announced per documentation under “Az 12.0.0 Migration Guide” of cmdlet break changes and property deprecations such as “PolicyDefinitionID” :

[Migration guide for Az 12.0.0 | Microsoft Learn](https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fpowershell%2Fazure%2Fmigrate-az-12.0.0%3Fview%3Dazps-12.3.0%23get-azpolicydefinition&data=05%7C02%7Cwangalex%40microsoft.com%7Ced736a2e201a448e1f4708dcde708671%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638629822159697282%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=E9jwxW11eWP9iNF7vFl24PzHjp3sbjrAetVkWq36U7s%3D&reserved=0)

Because the script is 3 or 4 years old, there has been no updates to the format of calling the proper properties of certain Az cmdlets that are mentioned in Migration guide documentation. Script may face more related failures/errors in Pipeline until all usage of Az cmdlets in reference to fetching their certain properties have the proper updates format. Because this scope involves reconfiguration of PowerShell script(s) and not break/fix support scenario, an expert in this area is needed to assist this strategic customer.

### Issue script & Debug output

```PowerShell
TROUBLESHOOTING: A collection of debug logs were taken over the course of 2 weeks, implementing Verbose statement to output the variable “$existingPolicyDefintions” that was linked to the Az cmdlet Get-AzPolicyDefinition that was being executed in the "Set-InitiativeDefinitions" PS script withing the pipeline to pull the list of policy definitions defined at the tenant level scope, at first there was conflict in pulling the proper output of the ids from the var as for a couple instances it's ouput in the debug was found empty or the id would have an additional quotation mark appended at the end. Either of these outputs in comparison to the id that it should equal within the if condition of the script would result in failure and script termination.

It was finally determined debugging at the source of where the $existingPolicyDefinitions" was created that when trying to retrieve the ids of the policies at tenant ($existingPolicyDefinitions | select PolicyDefinitionID) fetching property “PolicyDefinitionID” the results were null, indicating the property being fetched does not exists within the configuration of the policy definition resource output.

After separate testing with the Get-AzPolicyDefinition cmdlet to see what output looks like for the proeprties of a policy definition, it appears the policy id is under a section call “id” and not “PolicyDefinitionID”. Once it was tested to switch out every instance of implementations of fetching the PolicyDefinitionID property to “id” from the var $existingPolicyDefinitions, the output of getting the proper policy ids was successful eliminating the specified error.
```

### Environment data

```PowerShell
PS
```

### Module versions

```PowerShell
Az.Resource
```

### Error output

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the Get-AzPolicyDefinition output and the Set-InitiativeDefinitions PowerShell script described in the issue, then consult the Az 12.0.0 migration guide for the cmdlet's property changes. Done means the tenant-level policy definitions are retrieved consistently and the ADO pipeline can create or deploy the initiative without the specified-scope error.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.