[ARM] az policy definition version create fails with undocumented feature gate for custom definitions

[chenchengccccc]

Describe the bug

az policy definition version create cannot create a version for a custom policy definition in my AzureCloud subscription. The service says the feature is disabled in this environment.

This does not appear to be a CLI syntax, RBAC, scope, or API-version issue:

• Creating the root custom definition with --version 1.0.0 succeeds.
• The caller is Owner.
• The failure is identical at subscription and management-group scope.
• Direct REST calls return the same error.
• The stable REST API documents policyType: Custom, but I cannot find a feature-registration or enrollment step.

Related command

az policy definition create \
  --name <definition-name> \
  --display-name "Policy versioning repro" \
  --rules policy-rules.json \
  --version 1.0.0

az policy definition version create \
  --name <definition-name> \
  --version 1.1.0 \
  --display-name "Policy versioning repro" \
  --rules policy-rules.json

Errors

(InvalidPolicyDefinitionVersionRequest) Creating policy definition versions is currently disabled in this environment. Please contact support for any questions.

Updating the root definition from version 1.0.0 to 1.1.0 also fails:

(InvalidVersionIdentifier) Changing the value of the 'version' property is not yet supported in this environment.

Issue script & Debug output

The request reaches Microsoft.Authorization/policyDefinitions/versions/write and passes authorization. I also tested the REST endpoint with API versions from 2023-04-01 through 2026-01-01-preview; all return the same service-side error. az feature list shows no relevant registration feature.

Subscription, tenant, and request identifiers are omitted from this public issue.

Expected behavior

Please clarify how a customer subscription can use this command:

• If custom policy-definition versioning is generally available, what enables it in a subscription where it is currently disabled?
• If it is allowlisted or preview-only, what is the enrollment path?

The CLI help and REST documentation should state any rollout or enrollment requirement.

Environment Summary

azure-cli                         2.89.1
core                              2.89.1
azure-mgmt-resource               24.0.0
Python (Darwin)                   3.14.6
Cloud                             AzureCloud

Additional context

• REST API: https://learn.microsoft.com/en-us/rest/api/policy/policy-definition-versions/create-or-update?view=rest-policy-2025-11-01
• CLI PR adding the GA commands: [ARM] az policy: Rewrite Azure Policy CRUD commands using auto-generation #33416
• The CLI live-test recording successfully creates custom versions in a Microsoft test environment: https://github.com/Azure/azure-cli/blob/2dc0e0415ce83ca21e6d04ab26e038487881e0f8/src/azure-cli/azure/cli/command_modules/resource/tests/latest/recordings/test_resource_policy_version_default.yaml

[yonzhan]

Thank you for opening this issue, we will look into it.