Not possible to update policyDefinitionReferenceId with New- or Update-AzPolicySetDefinition

[vegazbabz]

Description

I want to update my policyDefinitionReferenceIds in my policy initiative definition definitions.json.

I am using a policy initiative definition file:
networkdef.json
and a parameter file:
networkparam.json
These 2 files are how I created the policy initiative definition. However, the policyDefinitionReferenceIds is being overwritten by the system and automatically generated. You can see that result in the first file (definitions.json)

To create the definition, I use this command:

$metadata = ConvertTo-Json @{ version = "1.0.0"; category = "Network" }

New-AzPolicySetDefinition `
-Name 'Enforce-Guardrails-Network' `
-DisplayName 'Enforce recommended guardrails for Network and Networking services' `
-PolicyDefinition C:\temp\networkdef.json `
-Parameter C:\Temp\networkparam.json `
-ManagementGroupName 'MG-ID' `
-Description 'This policy initiative is a group of policies that ensures Network and Networking services are compliant per regulated Landing Zones.' `
-Metadata $metadata

The above code, should have created the policyDefinitionReferenceIds for me. However, it is ignored as I said.

When I then try to update them again, I get the same result regardless if I use Update-AzPolicySetDefinition or New-AzPolicySetDefinition.
New-AzPolicySetDefinition -Name 'Enforce-Guardrails-Network' -PolicyDefinition .\definitions.json -Parameter .\networkparam.json
or
Update-AzPolicySetDefinition -Name 'Enforce-Guardrails-Network' -PolicyDefinition .\definitions.json -Parameter .\networkparam.json

Output:

  {
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
    "policyDefinitionReferenceId": "15299596690223791311",
    "groupNames": []
  }

Expected Output

  {
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
    "policyDefinitionReferenceId": "Deny-Nsg-GW-subnet",
    "groupNames": [],
  }

When running the $DebugPreference it is clear that the property policyDefinitionReferenceId is not part of the properties available

Issue script & Debug output

"policyDefinitions": [
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
        "groupNames": []
      },

Environment data

Name                           Value
----                           -----
PSVersion                      7.4.2
PSEdition                      Core
GitCommitId                    7.4.2
OS                             Microsoft Windows 10.0.22631
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     3.0.0                 Az.Accounts                         {Add-AzEnvironment, Clear-AzCon…
Script     7.1.0                 Az.Resources                        {Export-AzResourceGroup, Export…

Error output

No errors. See above message.

[mentat9]

Thank-you for reporting this problem. I have repro'd the issue, and we are pursuing a fix. In the meantime, you can work around it by using the property name "id" instead of "policyDefinitionReferenceId" in your input file like this:

  {
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
    "id": "Deny-Nsg-GW-subnet",
    "groupNames": []
  }

This will correctly serialize to "policyDefinitionReferenceId" in the backend:

  {
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/35f9c03a-cc27-418e-9c0c-539ff999d010",
    "policyDefinitionReferenceId": "Deny-Nsg-GW-subnet",
    "groupNames": []
  }

Sorry for the inconvenience this has caused: we will address it on our end as soon as possible.