azure automation runbook cannot read properties of azure policy definition or assignment

Question

azure automation runbook cannot read properties of azure policy definition or assignment

Seekell, Roger 66

I have an Azure Automation Account. In my Runbook, I want to read the properties of a certain Policy Definition. Unfortunately, when the AA runs the PowerShell Runbook, it can only read the definition name, not its description or policy rule. My Automation Account ID has Reader on the management group. The script sees that there is an object, but only the name comes back with any value.

Please let me know how I can read properties of a policy definition like DisplayName and policyRule. Thanks.

I wrote this script to illustrate the problem. See the output below:

Connect-AzAccount -Identity | Out-Null

$policyDefs = Get-AzPolicyDefinition | Select-Object -First 3

if ($null -eq $policyDefs) {
    Write-Error "Policy definition named '$policyName' was not found."
    return $null
}

foreach ($policyDef in $policyDefs) {
    $propCount = ($policyDef.PsObject.Properties | Measure-Object).count
    Write-Output ("Property count:  " + $propCount)

    Write-Output ("ID:  " + $policyDef.Id)
    Write-Output ("name:  " + $policyDef.Name)
    Write-Output ("displayname:  " + $policyDef.DisplayName)
    Write-Output ("Policy Type:  " + $policyDef.PolicyType)

    Write-Output ("Policy if:  " + $policyDef.PolicyRule.if)
    Write-Output ("Policy then:  " + $policyDef.PolicyRule.then)

    Write-Output ("Policy if count:  " + $policyDef.PolicyRule.if.count)
    Write-Output ("Policy if equals:  " + $policyDef.PolicyRule.if.equals)

    $policyDef.PolicyRule.if.count.value | ForEach-Object {
        Write-Output ("Policy if count value:  " + $_)
    }

}

6/23/2025, 12:09:46 PM - Output: Property count: 7

6/23/2025, 12:09:46 PM - Output: ID:

6/23/2025, 12:09:46 PM - Output: name: 0004bbf0-5099-4179-869e-e9ffe5fb0945

6/23/2025, 12:09:46 PM - Output: displayname:

6/23/2025, 12:09:47 PM - Output: Policy Type:

6/23/2025, 12:09:47 PM - Output: Policy if:

6/23/2025, 12:09:47 PM - Output: Policy then:

6/23/2025, 12:09:47 PM - Output: Policy if count: 0

6/23/2025, 12:09:47 PM - Output: Policy if equals:

6/23/2025, 12:09:47 PM - Output: Policy if count value:

6/23/2025, 12:09:47 PM - Output: Property count: 7

6/23/2025, 12:09:47 PM - Output: ID:

6/23/2025, 12:09:47 PM - Output: name: 0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56

6/23/2025, 12:09:47 PM - Output: displayname:

6/23/2025, 12:09:47 PM - Output: Policy Type:

6/23/2025, 12:09:47 PM - Output: Policy if:

6/23/2025, 12:09:47 PM - Output: Policy then:

6/23/2025, 12:09:47 PM - Output: Policy if count: 0

6/23/2025, 12:09:47 PM - Output: Policy if equals:

6/23/2025, 12:09:47 PM - Output: Policy if count value:

6/23/2025, 12:09:47 PM - Output: Property count: 7

6/23/2025, 12:09:47 PM - Output: ID:

6/23/2025, 12:09:47 PM - Output: name: 001802d1-4969-4c82-a700-c29c6c6f9bbd

6/23/2025, 12:09:47 PM - Output: displayname:

6/23/2025, 12:09:47 PM - Output: Policy Type:

6/23/2025, 12:09:47 PM - Output: Policy if:

6/23/2025, 12:09:47 PM - Output: Policy then:

6/23/2025, 12:09:47 PM - Output: Policy if count: 0

6/23/2025, 12:09:47 PM - Output: Policy if equals:

6/23/2025, 12:09:47 PM - Output: Policy if count value:

Seekell, Roger 66 Reputation points

2025-06-23T16:29:03.95+00:00

Note, the script works if I run it in Cloud Shell or from my workstation: it returns all the properties of the definitions.

Accepted answer

2 additional answers

Your answer

Seekell, Roger 66 Reputation points

2025-06-23T16:29:03.95+00:00

Note, the script works if I run it in Cloud Shell or from my workstation: it returns all the properties of the definitions.

Answer 1

hossein jalilian 10,905 Volunteer Moderator

Thanks for posting your question in the Microsoft Q&A forum

What you can do to fix it:

Check permissions: Give the managed identity the Directory Readers role in Azure AD if you need user info, Make sure it has Reader or a custom role that allows reading policy definitions.

Select properties explicitly: Instead of using Select-Object by itself, try specifying exactly which fields you want to see, such as:

Get-AzPolicyDefinition | Select-Object Id, Name, DisplayName, Description, PolicyType, PolicyRule, Metadata | Format-List

Specify the management group: If your Automation Account is in a different scope, include the -ManagementGroupName parameter.

Update your PowerShell module: Make sure the Az.Resources module is version 7.3.0 or newer. Older versions might not show all properties.

Try fetching by ID: Sometimes it's better to get the policy definition by its ID directly. This may return the full object with all fields.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Seekell, Roger 66 Reputation points

2025-06-23T18:20:53.4733333+00:00

Hello, thank you for your response.

I see that the version of Az.Resources in my runbook using the PowerShell72 runtime environment is only 6.13.0.
How can I update that module inside an Azure Automation Account?
Seekell, Roger 66 Reputation points

2025-06-24T18:53:40.1433333+00:00

Are there alternative ways to read a policy definition (the policy rule) besides the Az.Resources PowerShell module?

Answer 2

Seekell, Roger 66

Thanks to the clue by @hossein jalilian I realized that the PowerShell72 runtime includes an old version of the Get-AzPolicyDefinition. I worked around the problem by creating my own runtime env with the latest version of Az.Resources and Az.Accounts.

Also, I worked around the problem by using:

(az policy definition show --name "name" --management-group "name" | ConvertFrom-Json)

to get the information without changing the runtime environment.

Rahul Jorrigala 655 Reputation points Microsoft External Staff Moderator

2025-06-25T14:03:30.4333333+00:00

Hello Seekell, Roger,

Just checking in to see if the above answer provided by @hossein jalilian helped.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 3

Hello Seekell, Roger,

I hope this helps! Please let me know if you need any modifications or additional details.


Connect-AzAccount -Identity | Out-Null
$subscriptions = Get-AzSubscription

foreach ($subscription in $subscriptions) {
    Set-AzContext -SubscriptionId $subscription.Id
    $policyComplianceData = Get-AzPolicyState
    $policyDefinitions = Get-AzPolicyDefinition
    $initiatives = Get-AzPolicySetDefinition

    foreach ($policy in $policyComplianceData) {
        $resourceName = $policy.ResourceId -split '/' | Select-Object -Last 1

        $policyDefinition = $policyDefinitions | Where-Object { $_.Id -eq $policy.PolicyDefinitionId }
        $initiativeDefinition = $initiatives | Where-Object { $_.Id -eq $policy.PolicyDefinitionId }

        $policyType = ""
        $policyName = ""
        $policyId = ""

        if ($policyDefinition) {
            $policyType = "Policy Definition"
            $policyName = $policyDefinition.DisplayName
            $policyId = $policyDefinition.Id
        } elseif ($initiativeDefinition) {
            $policyType = "Initiative"
            $policyName = $initiativeDefinition.DisplayName
            $policyId = $initiativeDefinition.Id
        }

        $obj = [PSCustomObject]@{
            SubscriptionName        = $subscription.Name
            ComplianceState         = $policy.ComplianceState
            ResourceGroup           = $policy.ResourceGroup
            ResourceName            = $resourceName
            ResourceType            = $policy.ResourceType
            ResourceLocation        = $policy.ResourceLocation
            Timestamp               = $policy.Timestamp
            ResourceId              = $policy.ResourceId
            IsCompliant             = $policy.IsCompliant
            PolicyDefinitionAction  = $policy.PolicyDefinitionAction
            PolicyType              = $policyType
            PolicyName              = $policyName
            PolicyId                = $policyId
        }

        Write-Output $obj
    }
}

Output Reference:

User's image

Please let me know if you face any challenge here, I can help you to resolve this issue further

Provide your valuable Comments.

Please do not forget to "Accept the answer" and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Share via

azure automation runbook cannot read properties of azure policy definition or assignment

2 additional answers

Your answer