ARM template does not identify policy function

Question

When trying to deploy policy definitions using New-AzSubscriptionDeployment, it doesn't recognize the built-in policy functions.

Below is the deployment json.

{  
    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",  
    "contentVersion": "1.0.0.0",  
    "resources": [  
        {  
            "type": "Microsoft.Authorization/policyDefinitions",  
            "name": "storage-audit-secure-transfer-enabled",  
            "apiVersion": "2019-09-01",  
            "properties": {  
                "displayName": "storage-audit-secure-transfer-enabled",  
                "policyType": "Custom",  
                "mode": "All",  
                "description": "Audit requirement of Secure transfer in your storage account.",  
                "parameters": {},  
                "policyRule": {  
                    "if": {  
                        "allOf": [  
                            {  
                                "field": "type",  
                                "equals": "Microsoft.Storage/storageAccounts"  
                            },  
                            {  
                                "anyOf": [  
                                    {  
                                        "allOf": [  
                                            {  
                                                "value": "[requestContext().apiVersion]",  
                                                "less": "2019-04-01"  
                                            },  
                                            {  
                                                "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",  
                                                "exists": "false"  
                                            }  
                                        ]  
                                    },  
                                    {  
                                        "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",  
                                        "equals": "false"  
                                    }  
                                ]  
                            }  
                        ]  
                    },  
                    "then": {  
                        "effect": "audit"  
                    }  
                }  
            }  
        }  
    ]  
}  

Answer 1

Hi @Jorell Macapagal ,

Welcome to Microsoft Q&A! Thanks for posting the question.

There are some differences in functions() as available in ARM templates and Policy definition. The requestContext().apiVersion function is available to use in a policy rule, but differs from use in an Azure Resource Manager template (ARM template). Similarly, all Resource Manager template functions are available to use within a policy rule, except a few functions and user-defined functions.

Please refer to this link for more details.

As a workaround, I would request using the Portal to create Policy definition when these functions are to be used. Please let me know if you have any questions.

---
Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.