Custom Guest Configuration policies fail when cloned via the Azure Portal.

Hello @Kushi Yadav

Thank you for posting your query on Microsoft Q&A platform.

When you use “Duplicate definition” in the Azure Portal for a Guest Configuration policy, the portal does not correctly preserve the guestConfiguration metadata block (such as contentUri, contentHash, name, or version).

Because of this, the duplicated policy cannot correctly map to the original Guest Configuration package, so the Guest Configuration service treats the assignment as invalid. As a result, all assigned VMs are evaluated as NonCompliant, even though their actual configuration is correct.

• Guest Configuration policies rely on a precise metadata section (metadata.guestConfiguration) to link the policy to the underlying configuration package.
• The portal “Duplicate definition” action does not reliably clone this metadata, which breaks compliance evaluation.
• This is a known limitation with portal-based duplication for Guest Configuration policies.

Microsoft supports creating custom Guest Configuration policies by:

• Authoring or exporting the policy JSON (using PowerShell / CLI)
• Ensuring the guestConfiguration metadata (including content URI and hash) is preserved exactly

The New-GuestConfigurationPolicy PowerShell cmdlet is designed to generate this metadata correctly and avoids this issue.

Please have a look into below resolution:

Instead of using the portal, duplicate the policy definition using the Policy Insights API. The following PowerShell sample can copy the policy definition including the metadata using Az.Resources 7.3.0 or higher.

# duplicates the built-in policy which audits Windows machines for pending reboots
$def = Get-AzPolicyDefinition -id "/providers/Microsoft.Authorization/policyDefinitions/4221adbc-5c0f-474f-88b7-037a99e6114c"
New-AzPolicyDefinition -name (new-guid).guid -DisplayName "$($def.DisplayName) (Copy)" -Description $def.Description -Metadata ($def.Metadata | convertto-json) -Parameter ($def.Parameter | convertto-json) -Policy ($def.PolicyRule | convertto-json -depth 15)
 

Thanks,

Suchitra.