Is your feature request related to a problem? Please describe.
When EPAC manages Azure Policy assignments that reference built-in policy definitions directly, it would be useful for Build-DeploymentPlans to detect when a newer major version of the built-in policy definition is available.
Today, if an existing assignment has definitionVersion set to something like 1.*.*, and the built-in policy definition has since advanced to 2.0.0, EPAC does not surface this as drift or as an available update unless the desired assignment explicitly defines definitionVersion.
Describe the solution you'd like
It would be helpful if EPAC could optionally detect and report available major version updates for built-in policy definitions used by managed assignments.
Add optional detection logic during assignment plan generation
For each managed assignment referencing a built-in policy or policy set:
- read the deployed assignment definitionVersion
- read the latest built-in definition version from the policy definition metadata/model already loaded by EPAC
- compare major versions
- If the deployed assignment is on an older major version, add an advisory entry to the deployment plan or detailed output
For EPAC users, the current behavior means assignments can quietly remain on an older major version even though the latest built-in policy definition has had new major versions.
A warning when building deployment plans would be good.
An optional parameter to build-deploymentplans to include major version upgrades would be very nice.
Is your feature request related to a problem? Please describe.
When EPAC manages Azure Policy assignments that reference built-in policy definitions directly, it would be useful for
Build-DeploymentPlansto detect when a newer major version of the built-in policy definition is available.Today, if an existing assignment has
definitionVersionset to something like1.*.*, and the built-in policy definition has since advanced to2.0.0, EPAC does not surface this as drift or as an available update unless the desired assignment explicitly definesdefinitionVersion.Describe the solution you'd like
It would be helpful if EPAC could optionally detect and report available major version updates for built-in policy definitions used by managed assignments.
Add optional detection logic during assignment plan generation
For each managed assignment referencing a built-in policy or policy set:
For EPAC users, the current behavior means assignments can quietly remain on an older major version even though the latest built-in policy definition has had new major versions.
A warning when building deployment plans would be good.
An optional parameter to build-deploymentplans to include major version upgrades would be very nice.