[ARM] az policy definition version create fails with undocumented feature gate for custom definitions

Abierto
  • ¿Algo no está bien?
#33,890 1 comentario 0 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@isra-fel ya está trabajando en esto.

Desde el 13/8/2026.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

ARM Azure CLI Team question
Describe the bug

az policy definition version create cannot create a version for a custom policy definition in my AzureCloud subscription. The service says the feature is disabled in this environment.

This does not appear to be a CLI syntax, RBAC, scope, or API-version issue:

  • Creating the root custom definition with --version 1.0.0 succeeds.
  • The caller is Owner.
  • The failure is identical at subscription and management-group scope.
  • Direct REST calls return the same error.
  • The stable REST API documents policyType: Custom, but I cannot find a feature-registration or enrollment step.
Related command
az policy definition create \
  --name <definition-name> \
  --display-name "Policy versioning repro" \
  --rules policy-rules.json \
  --version 1.0.0

az policy definition version create \
  --name <definition-name> \
  --version 1.1.0 \
  --display-name "Policy versioning repro" \
  --rules policy-rules.json
Errors
(InvalidPolicyDefinitionVersionRequest) Creating policy definition versions is currently disabled in this environment. Please contact support for any questions.

Updating the root definition from version 1.0.0 to 1.1.0 also fails:

(InvalidVersionIdentifier) Changing the value of the 'version' property is not yet supported in this environment.
Issue script & Debug output

The request reaches Microsoft.Authorization/policyDefinitions/versions/write and passes authorization. I also tested the REST endpoint with API versions from 2023-04-01 through 2026-01-01-preview; all return the same service-side error. az feature list shows no relevant registration feature.

Subscription, tenant, and request identifiers are omitted from this public issue.

Expected behavior

Please clarify how a customer subscription can use this command:

  • If custom policy-definition versioning is generally available, what enables it in a subscription where it is currently disabled?
  • If it is allowlisted or preview-only, what is the enrollment path?

The CLI help and REST documentation should state any rollout or enrollment requirement.

Environment Summary
azure-cli                         2.89.1
core                              2.89.1
azure-mgmt-resource               24.0.0
Python (Darwin)                   3.14.6
Cloud                             AzureCloud
Additional context
Lenguaje dominante
Python
Estrellas
4.7k
Forks
3.5k
Merge medio
4 d 14 h
PR fusionados (30 d)
92

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Azure/azure-cli

Todos los issues de Azure/azure-cli

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.