Loading...

Public Preview Announcement: Azure Policy Built-in Versioning

Public Preview Announcement: Azure Policy Built-in Versioning

Welcome to a new era of policy management, where policy definitions are more agile, adaptable, and accessible than ever before! We are thrilled to introduce version management support for controlled built-in definition and initiative updates through Azure Policy. In a push to empower and simplify policy management, built-in definitions and initiatives will have the ability to store & reference multiple versions within a single definition ID. This new development will enhance your ability to govern, enforce and evolve your cloud governance policies. Keep reading for more information and be sure to check out our video walk-through of versioning to get started and learn more. 

 

What's new? Now, built-in definitions and initiatives can reference multiple versions within a single definition ID! This will help with:

 

  • Regulated updates: All built-in definitions will be reviewed and evaluated to stay aligned with versioning guidelines standards.
  • Change Management: Version will provide visibility into the evolution of built-in definitions and initiatives over each iteration.
  • Controlled application and enforcement: Users can specify what version of the definition or initiative to be assessed against at assignment time. 
  • Gradual Rollout: Versioning in collaboration with assignment resource selectors and overrides can be used to introduce new versions of definitions gradually into the environment.
  • Testing and quality assurance: Different versions of definitions may undergo different stages of roll out and application.  
  • Versioning awareness: Applicable version number will be shown in compliance logs on a per resource basis.

 

Ready to dive in? Keep reading to discover how you can get started with Policy versioning and make the most of these new capabilities!

 

Getting started 

All built-in definitions and initiatives have been updated to be on the latest current version. This can be seen in the portal, or through making a direct API call to the built-in definition. Through either client, you will see a new top-level version property (that follows semantic versioning format: #.#.#)

 

Now if that built-in definition were to introduce a new version, you would see the same definition ID but a new top level version number. With a slight change to the API call, you can retrieve other versions. See Policy Definition Versions - REST API (Azure Policy) | Microsoft Learn. If no version is specified, the latest version will be returned.

 

jodiboone_0-1720480236150.png

 

Portal:

When assigning a definition or initiative, users can select from either the current or previous versions while maintaining awareness of the version in your environment.

 

jodiboone_1-1720480236155.png

 

 

API Response:

The current version of the definition can also be seen through querying the definition ID, by default the latest version will be returned.

jodiboone_2-1720480236157.png

 

Important items to note: 

 

1. Assignment version reference 

All current assignments of built-in definitions and initiatives have been backfilled to reference the latest version of the definition and allow for updates on minor definition versions. Any assignment would ingest all minor changes as before but will not auto-ingest major or breaking changes.  If you do not want to ingest minor changes, you can update the existing assignment to pin to a minor version.

 

2. Understand patch change pattern.  

Assignments will not be able to pin to the patch version of definitions. Patch is reserved for non-impacting text changes and critical hotfixes. Patch changes require ingestions reserved for rare and special cases. Since a text change or definition category can occur without warning, please ensure any additional functionality relies on the definition ID and not the definition name as the name is dynamic, but ID is static.

 

3. Understand major vs minor updates.

Following semantic versioning, major updates occur when there is a breaking change to the definition. This could include introducing a new deny policy to a built-in initiative. A minor update does not include breaking changes but can include rule logic changes that enhance the scope of the definition’s applicability or changes to parameters. 

 

Stay tuned for more updates on Azure Policy features and releases here, and on X at @AzureGovernance.

 

Link to video overview of Policy versioning: https://youtu.be/eejdoDgofZ8

 

Published on:

Learn more
Azure Governance and Management Blog articles
Azure Governance and Management Blog articles

Azure Governance and Management Blog articles

Share post:

Related posts

Microsoft Whiteboard: Azure to OneDrive migration progress update

Microsoft Whiteboard storage is migrating from Azure to OneDrive, starting February 2024 and completing by August 2025, with full deprecation ...

17 hours ago

Copilot Studio: Azure AI Search Complete Setup Guide

Copilot Studio can use an Azure AI Search index as knowledge to answer Users questions ... The post Copilot Studio: Azure AI Search Complete S...

3 days ago

Microsoft Azure Fundamentals #1: Creating External Tenants in Entra ID: A Step-by-Step Guide

It is important to configure external tenants for different scenarios. In this post we can see how to create a tenant step by step so that it ...

3 days ago

Azure Information Protection: Enable multifactor authentication for your Azure tenant by October 1, 2025

Microsoft will enforce multifactor authentication (MFA) for all Azure resource management actions starting October 1, 2025, with a postponemen...

5 days ago

Azure Automation Custom Runtime Environments

A custom runtime environment is a way of defining a specific job execution environment for Azure Automation runbooks, including Microsoft Grap...

5 days ago

Dynamics 365 Customer Insights – Data – Export your data to Azure Data Lake Storage

We are announcing the general availability of the export to Azure Data Lake Storage (ADLS) feature in Dynamics 365 Customer Insights – Data on...

6 days ago

Dynamics 365 Business Central: Quickly find the Tenant ID, Azure AD Instance, and Tenant Scope from the domain (tenant) name without signing in

Hi, Readers.Today I would like to share another mini tip, how to quickly find the Tenant ID, Azure AD Instance, and Tenant Scope from the doma...

9 days ago

Starting Power BI deployment pipelines from Azure DevOps

Deployment pipelines in Power BI/ Microsoft Fabric have become crucial for managing and automating the deployment of Power BI content across e...

9 days ago

Video: Copilot Studio: Azure AI Search Complete Setup Guide

With Azure AI Search you can create a custom search engine of your company’s documents ... The post Video: Copilot Studio: Azure AI Search Com...

10 days ago
Stay up to date with latest Microsoft Dynamics 365 and Power Platform news!
* Yes, I agree to the privacy policy