Add policy/definition version

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_appgw_waf.tmpl.json

@@ -12,6 +12,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/564feb30-bf6a-4854-b4bb-0d2d2d1e6c66",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_res_location_match_rg_location.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0a914e76-4921-4c19-b460-a2d36003525a",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_audit_zoneresiliency.tmpl.json

@@ -15,6 +15,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/130fb88f-0fc9-4678-bfe1-31022d71c7d5",
+    "definitionVersion": "1.*.*-preview",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_classic-resources.tmpl.json

@@ -73,6 +73,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6c112d4e-5bc7-47ae-a041-ea2d9dccd749",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_http_ingress_aks.tmpl.json

@@ -12,6 +12,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d",
+    "definitionVersion": "8.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_hybridnetworking.tmpl.json

@@ -24,6 +24,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6c112d4e-5bc7-47ae-a041-ea2d9dccd749",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_ip_forwarding.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/88c0b9da-ce96-4b03-9635-f29a937e2900",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_containers_aks.tmpl.json

@@ -12,6 +12,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/95edb821-ddaf-4404-9732-666045e056b4",
+    "definitionVersion": "9.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_priv_escalation_aks.tmpl.json

@@ -12,6 +12,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/1c6e92c9-99f0-4e55-9cf2-0c234dc48f99",
+    "definitionVersion": "7.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip.tmpl.json

@@ -17,6 +17,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/6c112d4e-5bc7-47ae-a041-ea2d9dccd749",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_public_ip_on_nic.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/83a86a26-fd1f-447c-b59d-e51f44264114",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_storage_http.tmpl.json

@@ -12,6 +12,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deny_unmanageddisk.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/06a78e20-9358-41c9-923c-fb736d382a4d",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default",
     "overrides": [

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_asc_monitoring.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8",
+    "definitionVersion": "57.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azactivity_log.tmpl.json

@@ -15,6 +15,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2465583e-4e78-4c15-b6be-a36cbc7c8b0f",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_azsql_db_auditing.tmpl.json

@@ -15,6 +15,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/25da7dfb-0666-4a15-a8f5-402127efd8bb",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_log_analytics.tmpl.json

@@ -33,6 +33,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/8e3e61b3-0b32-22d5-4edf-55f87fdb5955",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "DoNotEnforce"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_md_endpoints_ama.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/77b391e3-2d5d-40c3-83bf-65c846b3c6a3",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdeendpoints.tmpl.json

@@ -21,6 +21,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/e20d08c5-6d64-656d-6465-ce9e37fd0ebc",
+    "definitionVersion": "1.*.*-preview",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_ossdb.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/e77fc0b3-f7e9-4c58-bc13-cb753ed8e46e",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sql-ama.tmpl.json

@@ -24,6 +24,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/de01d381-bae9-4670-8870-786f89f49e26",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_mdfc_sqlatp.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/9cb3cc7a-b39b-4b82-bc89-e5a5d9ff7b97",
+    "definitionVersion": "3.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_resource_diag.tmpl.json

@@ -12,6 +12,8 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/0884adba-2312-4468-abeb-5422caed1038",
+    "definitionVersion": "1.0.0",
+    "conditionalDefinitionVersion": "1.0.0",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_tde.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/86a912f6-9a06-4e26-b447-11b16ba8659f",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_sql_threat.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/36d49e87-48c4-4f2e-beed-ba4ed02b71f5",
+    "definitionVersion": "2.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_changetrack.tmpl.json

@@ -15,6 +15,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/53448c70-089b-4f52-8f38-89196d7f2de1",
+    "definitionVersion": "1.*.*-preview",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_arc_monitor.tmpl.json

@@ -18,6 +18,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/2b00397d-c309-49c4-aa5a-f0b2c5bc6321",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_backup.tmpl.json

@@ -12,6 +12,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/98d0b9f8-fd90-49c9-88e2-d3baf3b0dd86",
+    "definitionVersion": "9.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_changetrack.tmpl.json

@@ -24,6 +24,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/92a36f05-ebc9-4bba-9128-b47ad2ea3354",
+    "definitionVersion": "1.*.*-preview",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vm_monitor.tmpl.json

@@ -30,6 +30,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/924bfe3a-762f-40e7-86dd-5c8b95eb09e6",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_changetrack.tmpl.json

@@ -24,6 +24,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/c4a70814-96be-461c-889f-2b27429120dc",
+    "definitionVersion": "1.*.*-preview",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_deploy_vmss_monitor.tmpl.json

@@ -30,6 +30,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/f5bf694c-cca7-4033-b883-3a23327d5485",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enable_ddos_vnet.tmpl.json

@@ -15,6 +15,7 @@
       }
     },
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/94de2ad3-e0c1-4caf-ad78-5d47bbc83d3d",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_subnet_private.tmpl.json

@@ -8,6 +8,7 @@
     "notScopes": [],
     "parameters": {},
     "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7bca8353-aa3b-429b-904a-9229c4385837",
+    "definitionVersion": "1.*.*",
     "scope": null,
     "enforcementMode": "Default"
   },

infra-as-code/bicep/modules/policy/assignments/lib/policy_assignments/policy_assignment_es_enforce_tls_ssl.tmpl.json

@@ -1,5 +1,5 @@
 {
-  "name": "Enforce-TLS-SSL-H224",
+  "name": "Enforce-TLS-SSL-Q225",
   "type": "Microsoft.Authorization/policyAssignments",
   "apiVersion": "2024-04-01",
   "properties": {

infra-as-code/bicep/modules/policy/assignments/policyAssignmentManagementGroup.bicep

@@ -50,6 +50,9 @@ param parPolicyAssignmentOverrides array = []
 @description('List of required resource selectors for the policy assignment.')
 param parPolicyAssignmentResourceSelectors array = []
 
+@description('The version of the policy definition to use.')
+param parPolicyAssignmentDefinitionVersion string?
+
 @allowed([
   'None'
   'SystemAssigned'
@@ -93,6 +96,7 @@ resource resPolicyAssignment 'Microsoft.Authorization/policyAssignments@2025-01-
     enforcementMode: parPolicyAssignmentEnforcementMode
     overrides: parPolicyAssignmentOverrides
     resourceSelectors: parPolicyAssignmentResourceSelectors
+    definitionVersion: parPolicyAssignmentDefinitionVersion
   }
   identity: {
     type: varPolicyIdentity