Export-AzPolicyAssignmentDafa returning 0 assignments in azure pipeline

[Preetha878]

I'm trying to convert my policy as rule and validate against my bicep template

Steps followed:
Step up in local:
Powershell version 5 nd 7 both are working as expected
Modules installed: Az.Accounts, Az.Resources (6.7.0), PSRule.Azure....
Get-AzPolicyAssignment -Scope - got expected result
Iterated through assignments from above command and provided as input to. Below command
Export-AzPolicyAssignmentData -name "assignment name" -Scope "scopeofassogmment"

Able to get the result and create the json file and convert as ps compatible rules and validate against bicep

But in azure pipeline
I used below task and test with both psversion 5 and 7

Issue:

-task : Powershell@2 - I tried to authenticate using service principle and installed modules like Az.Accounts and Az.Resources and for PS rules and also imported and used Get-AzPolicyAssignment and able to get output but this Export-AzPolicyAssignmentData is giving "0 assignments found " when I set pwsh to true (powershell version 7) and Connect-AzAccount is not able to connect for Export-AzPolicyAssignmentData for pwsh:false (powershell version 5)

Same issue as PowerShell@2 for AzurePowerShell@5
I tried installing module for Az.Resources explicitly with version 6.7.0 but couldn't override the default one from Az module that comes with AzurePowerShell@5

Pls guide me here
I'm basically blocked here

Thanks in advance

[BernieWhite]

Hi @Preetha878 thanks for the question. Let me summarise the issue to make sure I understand the question and where you are having an issue.

You have tried running the following locally and it works as expected:

1. Installed Az.Accounts and Az.Resources.
2. Exported assignments with Export-AzPolicyAssignmentData -Scope <nnn>, which generated one or more *.assignment.json files.
3. Generated rules with Export-AzPolicyAssignmentRuleData -name "assignment name" -Scope "scopeofassogmment", which generated a *.Rule.jsonc file.
4. Tested rules work as expected with Bicep code.

When trying this in Azure Pipelines you are having an issue, you have tried the PowerShell@2 and AzurePowerShell@5 both with Windows PowerShell and PowerShell 7.x.

Have I understood you correctly?

---

There is some changes in the latest version of PSRule for Azure (v1.45.0) so are you able to let me know what version of PSRule for Azure you are using?

From v1.45.0, PSRule for Azure no longer has a dependency on Az.Resources so it does not need to be installed or be a specific version. Prior versions did have some compatibility issues with newer versions of Az.Resources so we have been working to remove this issue.

Az.Accounts is still used for authentication, however any version of Az.Accounts should work from v3.x to the current version, as there is no known compatibility issues at this time. The version included in AzurePowerShell@5 should work,

Also it's important to note, that only the Export-AzPolicyAssignmentData cmdlet requires connectivity to Azure. The easiest way to run this is with the AzurePowerShell@5 task.

You can choose to run both the Export-AzPolicyAssignmentData and Export-AzPolicyAssignmentRuleData cmdlets in the same PowerShell task but it's not required. For the sake of debugging we'll try both in the same task to simplify the pipeline.

---

Next steps:

1. Update to PSRule for Azure v1.45.0. i.e. Install-Module PSRule.Rules.Azure -RequiredVersion 1.45.0 -Force.
2. Update your pipeline to include a AzurePowerShell@5 task similar to the following:

    - task: AzurePowerShell@5
      inputs:
        # Set this input to the computed value
        azureSubscription: '<your_connection>'
        azurePowerShellVersion: 'LatestVersion'
        scriptType: 'InlineScript'
        inline: |
          Export-AzPolicyAssignmentData -Scope <nnn> -Verbose | ForEach-Object { Export-AzPolicyAssignmentRuleData -Verbose -AssignmentFile $_ }

Are you able to provide further information based on the results of running the pipeline.

[Preetha878]

Hi @BernieWhite ,

Thanks for the quick response

In local im using PSRule.Rules.Azure version 1.44.2

I tried with the following task

• task: AzurePowerShell@5
  inputs:
  azureSubscription: '<myservice-connection'
  azurePowerShellVersion: 'LatestVersion'
  ScriptType: 'InlineScript'
  pwsh: false
  Inline: |
  Install-Module -Name PSRule.Rules.Azure -RequiredVersion 1.45.0 -Scope CurrentUser -Force
  Import-Module PSRule.Rules.Azure
  Export-AzPolicyAssignmentData -Name "" -Scope "<scope-of-assignment" -Verbose -debug

Below is my pipeline output:

VERBOSE: Command [Set-AzContext] succeeded.
VERBOSE: [Export-AzPolicyAssignmentData] BEGIN::
DEBUG: 4:33:51 AM - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning
default value [True].
DEBUG: 4:33:51 AM - GetAzureRMContextCommand begin processing with ParameterSet 'GetSingleContext'.
##[error]Could not find an existing context. Use Connect-AzAccount to establish a PowerShell context with Azure.
##[error]PowerShell exited with code '1'.
Added TLS 1.2 in session.
##[command]Disconnect-AzAccount -Scope CurrentUser -ErrorAction Stop
##[command]Disconnect-AzAccount -Scope Process -ErrorAction Stop
##[command]Clear-AzContext -Scope Process -ErrorAction Stop
##[section]Finishing: AzurePowerShell

with pwsh:true for AzurePowerShell@5

Im getting the below results

2 �[33;1mDEBUG: ClientSecretCredential.GetToken succeeded. Scopes: [ https://management.core.windows.net//.default ] ParentRequestId: ExpiresOn: 2025-07-16T05:51:34.4462006+00:00�[0m
[33;1mDEBUG: 4:51:35 AM - [ConfigManager] Got nothing from [DisplaySecretsWarning], Module = [], Cmdlet = []. Returning default value [True].�[0m
[33;1mDEBUG: 4:51:35 AM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].�[0m
�[33;1mDEBUG: 4:51:35 AM - [ConfigManager] Got [False] from [CheckForUpgrade], Module = [], Cmdlet = [].�[0m
�[33;1mDEBUG: AzureQoSEvent: Module: Az.Accounts:5.1.1; CommandName: Get-AzAccessToken; PSVersion: 7.4.11; IsSuccess: True; Duration: 00:00:00.1290253; SanitizeDuration: 00:00:00.0006996�[0m
�[33;1mDEBUG: 4:51:35 AM - [ConfigManager] Got nothing from [EnableDataCollection], Module = [], Cmdlet = []. Returning default value [True].�[0m
�[33;1mDEBUG: 4:51:35 AM - GetAzureRmAccessTokenCommand end processing.�[0m
�[33;1mVERBOSE: Added 0 assignments from scope ''.�[0m
�[33;1mVERBOSE: Expanding policy assignments with 4 threads.�[0m
�[33;1mVERBOSE: [Export-AzPolicyAssignmentData] END:: - 00:00:00.4418116�[0m
Added TLS 1.2 in session.
##[command]Disconnect-AzAccount -Scope CurrentUser -ErrorAction Stop
##[command]Disconnect-AzAccount -Scope Process -ErrorAction Stop
##[command]Clear-AzContext -Scope Process -ErrorAction Stop
##[section]Finishing: AzurePowerShell

[BernieWhite]

Thanks @Preetha878, are you able to share how your ADO service connection is configured without getting to specific and sharing anything sensitive:

• Is your service connection scoped at a management group scope level or subscription? See https://learn.microsoft.com/en-us/azure/devops/pipelines/library/service-endpoints?view=azure-devops
• Does the service principal/ managed identity have read permission to any subscription.

---

I suspect by the output your service connection is scoped to a management group and does not have read permission to any subscription. As a result there is no default context.

If this is the case, as a work around you could assign the Reader role on any subscription below the management group you are targeting.

Are you able to confirm? Currently Azure PowerShell requires a subscription. For working without any subscription we may need to add a feature to support Az CLI or something similar.

[Preetha878]

@BernieWhite
Yes my SPN associated with service connection has reader access over management group level scope and i tried to connect with same SPN from local and run the same Export-AzPolicyAssignmentData command and got the expected results but in azure pipeline its showing 0 as results

[BernieWhite]

Ok if there is a subscription below the management group then try inserting Set-AzContext -Subscription <guid> above the Export-AzPolicyAssignmentData line.

[Preetha878]

Yes actually i tried the same [Set-AzContext -Subscription ] but facing same issues

But with the below task, im able to generate the json file but with AzurePowerShell@5 with pwsh:true and pwsh:false its not working

Is there's a reason why its not working AzurePowerShell@5 and with PSRule.Rules.Azure for version 1.45.0?

• task: PowerShell@2
  inputs:
  targetType: 'inline'
  pwsh: true
  script: |
  Install-Module -Name Az.Accounts -Force -AllowClobber -Scope CurrentUser
  Import-Module Az.Accounts
  Install-Module -Name Az.Resources -RequiredVersion 6.7.0 -Force -AllowClobber -Scope CurrentUser
  Import-Module Az.Resources -RequiredVersion 6.7.0 -Force
  Install-Module -Name PSRule.Rules.Azure -RequiredVersion 1.44.2 -Scope CurrentUser -Force -AllowClobber
  Import-Module PSRule.Rules.Azure
  $tenantId = ""
  $appId = ""
  $secret = ConvertTo-SecureString "" -AsPlainText -Force
  $cred = New-Object System.Management.Automation.PSCredential($appId, $secret)
  Connect-AzAccount -ServicePrincipal -Tenant $tenantId -Credential $cred
  Get-AzContext
  Export-AzPolicyAssignmentData -Name -Scope -OutputPath $tempFolder

[BernieWhite]

@Preetha878 Not sure, let me try to reproduce the issue.