Understanding Inconsistent data return for Azure Powershell command Get-AzPolicyDefinition

Question

Hi, I'm encountering inconsistent data return for the Azure Powershell command Get-AzPolicyDefinition.

I have a script that obtains compliance reports for Azure Policy Initiatives and I iterate over each compliance item to obtain more information. I'm using two Azure Policy PowerShell commands Get-AzPolicyState and Get-AzPolicyDefinition. I'm running the script in two different environments (dev, prod), the command Get-AzPolicyDefinition is returning different data in my dev and prod environments.

Here's a snippet from my script

$resourceComplianceData = Get-AzPolicyState -SubscriptionId "xxxxxxx-xxxx-xxxx-xxxx-fxxx041xxxx" -ResourceGroupName "RG-Test" -Filter "(PolicyAssignmentName eq 'fcc12exx3e61003c1860' or PolicyAssignmentName eq 'SecurityCenterBuiltIn')"

foreach($complianceData in $resourceComplianceData){
    $policyInfo = Get-AzPolicyDefinition -Id $($complianceData.PolicyDefinitionId)| Select-Object -ExpandProperty properties
    $PolicyName = $policyInfo.DisplayName
    Write-Host "$PolicyName" 
}

I need to use Select-Object -ExpandProperty properties in one and shouldn't in another environment. As in

For prod

$policyInfo = Get-AzPolicyDefinition -Id $($complianceData.PolicyDefinitionId)| Select-Object -ExpandProperty properties

For dev

    $policyInfo = Get-AzPolicyDefinition -Id $($complianceData.PolicyDefinitionId)

1. Prod and Dev are in different subscriptions, I tried running on local machine in both the subscriptions but the Select-Object is what was working in both on a local machine.
2. The script is being run as a runbook in Automation Accounts(on a Hybrid worker), with Managed Identity to access and obtain Policy Data. Prod and Dev have separate resources(Automtion Accounts, Hybrid Workers, Identities etc)

Can someone help me understand the issue here? I'm trying to keep my code same in both dev and prod environments, but it isn't working.

TIA

Answer 1

Hello Jaswanth G,

Thanks for your question.

Based on the information above, it points to a difference in envs. There are a few things you could verify:

• The inconsistency could be due to different versions of the Az PowerShell module installed in your dev and prod environments.
• The Az PowerShell module might be using different API versions in your environments, which could lead to differences in the returned object structure.
• Check if the policy definitions themselves are identical across both environments. Any differences in the policy definitions could lead to different outputs.

Get-AzPolicyState -SubscriptionId "xxxxxxx-xxxx-xxxx-xxxx-fxxx041xxxx" -ResourceGroupName "RG-Test" -Filter "(PolicyAssignmentName eq 'fcc12exx3e61003c1860' or PolicyAssignmentName eq 'SecurityCenterBuiltIn')"

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola