PolicyDefinitionQuotaExceeded (500 limit) when using -SyncAMBAExtendedPolicies at root management group scope

[8ast1en]

Summary

When using Sync-ALZPolicyFromLibrary with the -SyncAMBAExtendedPolicies switch and then deploying via Build-DeploymentPlans + Deploy-PolicyPlan, we hit the Azure policy definition quota of
500 at the root management group scope.

I've follow the fix for the Linux path separator bug (#1311) is required before -SyncAMBAExtendedPolicies works on Linux/WSL #1309.

Steps to reproduce

# 1. Run AMBA extended sync                                                                                                                                                                          
Sync-ALZPolicyFromLibrary -DefinitionsRootFolder .\Definitions -Type AMBA -PacEnvironmentSelector "xxx" -SyncAMBAExtendedPolicies                                                                  
                                                                                                                                                                                                       
# 2. Build plan                                                                                                                                                                                        
Build-DeploymentPlans -DefinitionsRootFolder Definitions -OutputFolder Output -PacEnvironmentSelector xxx                                                                                          
                                                                                                                                                                                                       
# 3. Deploy — fails with quota error after ~197 new definitions                                                                                                                                        
Deploy-PolicyPlan -DefinitionsRootFolder .\Definitions -InputFolder .\Output -PacEnvironmentSelector xxx                                                                                          
                                                                                                                                                                                                       
Error                                                                                                                                                                                                  
                                                                                                                                                                                                       
{                                                                                                                                                                                                      
  "error": {                                                                                                                                                                                         
    "code": "PolicyDefinitionQuotaExceeded",                                                                                                                                                           
    "message": "Creating policy definition '<guid>' would exceed the quota at current scope. Existing policy definitions: '500', the quota is: '500'."                                                 
  }                                                                                                                                                                                                    
}                                                                                                                                                                                                      
  

Questions                                                                                                                                                                                              
 
1. Is this a known limitation when using -SyncAMBAExtendedPolicies at enterprise scale?                                                                                                                
2. Is there a recommended pattern to distribute AMBA extended policy definitions across multiple management group scopes (e.g., root for ALZ standard, landing-zones child MG for extended services)?                                                       
3. Is a quota increase request to Azure Support the recommended path, or is there an EPAC-native solution?


Thanks a lot,

[JamesDLD]

Same concern here, thanks for sharing

[anwather]

Hey - I'm sure it's a hard limit of 500 per scope, you could try a support request to see if it can be increased. I'm working on a fix for this which will allow policy definitions to be defined at different scopes. I'll check the AMBA extended policy repo to see if they have any guidance. Get Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: James Dumont Le Douarec ***@***.***> Sent: Wednesday, 27 May 2026 17:47:16 To: Azure/enterprise-azure-policy-as-code ***@***.***> Cc: Subscribed ***@***.***> Subject: Re: [Azure/enterprise-azure-policy-as-code] PolicyDefinitionQuotaExceeded (500 limit) when using -SyncAMBAExtendedPolicies at root management group scope (Issue #1315) Same concern here, thanks for sharing — Reply to this email directly, view it on GitHub<#1315 (comment)> or unsubscribe<https://github.com/notifications/unsubscribe-auth/ACWCJVW6AU55HK46ZXIRTMD442MQLBFKMF2HI4TJMJ2XIZLTSSBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLAVFOZQWY5LFVAYTQMBXGM4TCN5ENZQW2ZNIMFRXI33SL5UWJLDTOVRGUZLDORPXI6LQMWWES43TOVSUG33NNVSW45FGORXXA2LDOOJIFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVEZTGNZRGYZDQMZYQKSHI6LQMWSWS43TOVS2K5TBNR2WLKRUGUZTANJUG4YDSMVHORZGSZ3HMVZKMY3SMVQXIZI>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[anwather]

Linked to #1312

[8ast1en]

We opened a support ticket "2605270050000608" with Microsoft regarding this quota limitation.
Their response confirms this is a hard platform limit that cannot be increased:

"The limit of 500 policy definitions per scope (management group or subscription)
is a platform-enforced limit and cannot be increased. It's a hard limit."

Microsoft's suggested mitigations

1. Distribute definitions across multiple scopes — store definitions at different management groups, each with its own 500 quota
2. Extend management group hierarchy — add MG layers to create more scopes
3. Use built-in policies where possible (don't count against custom limit)
4. Use initiatives to group policies (reduces assignments, not definitions)
5. Consolidate/generalise custom policies into fewer parameterised definitions

We need to wait your FIX to onborad AMBA into the EPAC module for the moment

[anwather]

8ast1en - thanks for checking that.
(Not sure how Point 4 helps at all) ;)

[8ast1en]

sure, actually i will synch the AMBA extended policy and choose the policy that interests me for the moment