PowerShell Errors

[ericl42]

Hello everyone,

I was wanting to play around with with EPAC but I'm running into issues even with the quick start setup.

After running "Export-AzPolicyResources -DefinitionsRootFolder .\Definitions -OutputFolder Output" it finds various resource containers, MGs, subscriptions, etc., but one it goes to get the policy resources I get the following errors. I've reinstalled PS multiple times and wiped my entire environment, but continue to get the same errors.

It worked fine for my colleague so trying to determine what oddness I have going on with my PS setup.

Get Policy Resources for EPAC environment 'quick-start' at root scope /managementGroups/mg-base

Search-AzGraph: C:\Users\test\Documents\PowerShell\Modules\EnterprisePolicyAsCode\8.1.0\internal\functions\Search-AzGraphAllItems.ps1:10
Line |
  10 |      $result = Search-AzGraph $Query -First 1000 @scope
     |                                                  ~~~~~~
     | A parameter cannot be found that matches parameter name 'UseTenantScope'.
MethodInvocationException: C:\Users\test\Documents\PowerShell\Modules\EnterprisePolicyAsCode\8.1.0\internal\functions\Search-AzGraphAllItems.ps1:11
Line |
  11 |      $null = $data.AddRange($result.Data)
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "AddRange" with "1" argument(s): "Value cannot be null. (Parameter 'c')"

Search-AzGraph: C:\Users\test\Documents\PowerShell\Modules\EnterprisePolicyAsCode\8.1.0\internal\functions\Search-AzGraphAllItems.ps1:10
Line |
  10 |      $result = Search-AzGraph $Query -First 1000 @scope
     |                                                  ~~~~~~
     | A parameter cannot be found that matches parameter name 'UseTenantScope'.
MethodInvocationException: C:\Users\test\Documents\PowerShell\Modules\EnterprisePolicyAsCode\8.1.0\internal\functions\Search-AzGraphAllItems.ps1:11
Line |
  11 |      $null = $data.AddRange($result.Data)
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "AddRange" with "1" argument(s): "Value cannot be null. (Parameter 'c')"

Any help would be greatly appreciated!

[Acenl12]

How does your global-setting look like, have you filled in your tenant id there? @ericl42 . I have made the values bold that need to be changed tio the tenant id of your enviroment.

{
"$schema": "https://raw.githubusercontent.com/Azure/enterprise-azure-policy-as-code/main/Schemas/global-settings-schema.json",
"pacOwnerId": "11111111-2222-3333-4444-555555555555",
"pacEnvironments": [
{
"pacSelector": "epac-dev",
"cloud": "AzureCloud",
"tenantId": "77777777-8888-9999-1111-222222222222",
"deploymentRootScope": "/providers/Microsoft.Management/managementGroups/EPAC-Dev"
},
{
"pacSelector": "tenant",
"cloud": "AzureCloud",
"tenantId": "77777777-8888-9999-1111-222222222222",
"deploymentRootScope": "/providers/Microsoft.Management/managementGroups/Contoso-Root", // replaces rootScope
"inheritedDefinitionsScopes": [], // [optional] inherited definition scopes used but not managed by this repository, scopes must be visible from deploymentScope
"desiredState": { // [optional]
"strategy": "full", // default full
// full = delete any unknown assignments and Policy/Set definitions in managed scope not containing metadata.pacOwnerId
// ownedOnly = delete only our own assignments as indicated by metadata.pacOwnerId field
"includeResourceGroups": false,
"excludedScopes": [
// Management Groups
// Subscriptions
// Resource Groups
],
"excludedPolicyDefinitions": [
// wild cards allowed
],
"excludedPolicySetDefinitions": [
// wild cards allowed
],
"excludedPolicyAssignments": [
// wild cards allowed
]
}
}
],
"managedIdentityLocations": {
"": "eastus2"
},
"globalNotScopes": {
"": [
"/resourceGroupPatterns/excluded-rg*",
],
"tenant": [
"/providers/Microsoft.Management/managementGroups/EPAC-Dev"
]
}
}

[ericl42]

Appreciate the quick response @Acenl12 . Below is my config. It's very basic and I just modified the 3 fields that the "quick start" guide told me to.

My colleague has the exact same config as me minus the UID and it's working for him.

{
    "$schema": "https://raw.githubusercontent.com/Azure/enterprise-azure-policy-as-code/main/Schemas/global-settings-schema.json",
    "pacOwnerId": "<confirmed I have a unique ID here>",
    "managedIdentityLocations": {
        "*": "eastus"
    },
    "globalNotScopes": {
        "*": [
            "/resourceGroupPatterns/excluded-rg*"
        ]
    },
    "pacEnvironments": [
        {
            "pacSelector": "quick-start",
            "cloud": "AzureCloud",
            "tenantId": "<confirmed the correct tenant ID is here>",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/mg-base"
        }
    ]
}

[Acenl12]

The help of the command shows this:
Export-AzPolicyResources -DefinitionsRootFolder ./Definitions -OutputFolder ./Outputs -Interactive $true -IncludeChildScopes -IncludeAutoAssigned -ExemptionFiles csv -FileExtension jsonc -Mode export -InputPacSelector 'EPAC-Environment-1'

See here: https://github.com/Azure/enterprise-azure-policy-as-code/blob/main/Scripts/Operations/Export-AzPolicyResources.ps1
And the scroll down a bit to examples. (Line 53) @ericl42

Can you try that?

[ericl42]

Unfortunately it's the same error.

I may just have to punt on this system and try it on another one. Like I said previous, my colleague and I both followed the exact same process and his works with the same config + commands and mine errors out.

I was hoping uninstalling and reinstalling PS would filter out any odd issues that may be lingering, but that doesn't appear to be the case.

[Acenl12]

I'm also a user of EPAC, and I think @techlake might be able to help you as the co-developer.
Have you followed the quickstart to install all the proper modules? https://github.com/Azure/enterprise-azure-policy-as-code/blob/main/Docs/quick-start.md (the az modules had a lot of bugs so make sure those are the latest version). Please also list your PowerShell version using $PSVersionTable and this Get-Module EnterprisePolicyAsCode . Can you please try it with this global-settings : @ericl42

{
    "$schema": "https://raw.githubusercontent.com/Azure/enterprise-azure-policy-as-code/main/Schemas/global-settings-schema.json",
    "pacOwnerId": "11111111-2222-3333-4444-555555555555",
    "pacEnvironments": [
        {
            "pacSelector": "epac-dev",
            "cloud": "AzureCloud",
            "tenantId": "77777777-8888-9999-1111-222222222222",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/EPAC-Dev"
        },
        {
            "pacSelector": "tenant",
            "cloud": "AzureCloud",
            "tenantId": "77777777-8888-9999-1111-222222222222",
            "deploymentRootScope": "/providers/Microsoft.Management/managementGroups/Contoso-Root", // replaces rootScope
            "inheritedDefinitionsScopes": [], // [optional] inherited definition scopes used but not managed by this repository, scopes must be visible from deploymentScope
            "desiredState": { // [optional]
                "strategy": "full", // default full
                // full      = delete any unknown assignments and Policy/Set definitions in managed scope not containing metadata.pacOwnerId
                // ownedOnly = delete only our own assignments as indicated by metadata.pacOwnerId field
                "includeResourceGroups": false,
                "excludedScopes": [
                    // Management Groups
                    // Subscriptions
                    // Resource Groups
                ],
                "excludedPolicyDefinitions": [
                    // wild cards allowed
                ],
                "excludedPolicySetDefinitions": [
                    // wild cards allowed
                ],
                "excludedPolicyAssignments": [
                    // wild cards allowed
                ]
            }
        }
    ],
    "managedIdentityLocations": {
        "*": "eastus2"
    },
    "globalNotScopes": {
        "*": [
            "/resourceGroupPatterns/excluded-rg*",
        ],
        "tenant": [
            "/providers/Microsoft.Management/managementGroups/EPAC-Dev"
        ]
    }
}

[techlake]

Check your versions:
PS: 7.3.6
Azure PowerShell Module 9.3.0 (must be installed)

[techlake]

Make sure you have permissions to read stuff (Reader and Policy Contributor at the definition mg-base)