Tags for Restore-AzSqlDatabase not working with the cross subscription restore

[jayendranarumugam]

Description

We are trying to follow this tutorial trying to do the cross subscription

[hashtable]$tags = @{"region" = "eastus2"}


$SourceResourceGroupName = "xxttt"
$SourceSynapseWorkspaceName = "xxyy"
$SourceSqlPoolName = "sxxyy"

$RestorePointLabel = "abc"

$TargetResourceGroupName ="abc"
$TargetServerName = "abc"
$TargetDatabaseName = "ac"



$Sourcesqlpool = Get-AzSynapseSqlPool -ResourceGroupName $SourceResourceGroupName -WorkspaceName $SourceSynapseWorkspaceName -Name $SourceSqlPoolName

Write-Output $Sourcesqlpool


$restorePoint = $Sourcesqlpool | Get-AzSynapseSqlPoolRestorePoint | Where-Object {$_.RestorePointLabel -eq $RestorePointLabel}

Write-Output $restorePoint

$DestinationSubscriptionId = "abc"
Set-AzContext -SubscriptionId $DestinationSubscriptionId

$PointInTime = $RestorePoint.RestorePointCreationDate 

Write-Output $PointInTime



$RestoredDatabase = Restore-AzSqlDatabase -FromPointInTimeBackup -PointInTime $PointInTime `
    -ResourceGroupName $TargetResourceGroupName -Tag $tags `
    -ServerName $TargetServerName -TargetDatabaseName $TargetDatabaseName `
    -ResourceId $Sourcesqlpool.Id -Edition "DataWarehouse" `
    -ServiceObjectiveName "DW100c"

This script was finally failing on Restore-AzSqlDatabase where the tags is not getting applied to the new sqldb

Issue script & Debug output

Resource 'synapsedb' was disallowed by policy. Policy identifiers:
| '[{"policyAssignment":{"name":"Mandate and Audit Tags on Supported Resources}

Environment data

Name Value
---- -----
PSVersion 7.2.1
PSEdition Core
GitCommitId 7.2.1
OS Microsoft Windows 10.0.19044
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0

Module versions

Error output

Resource 'synapsedb' was disallowed by policy. Policy identifiers:
| '[{"policyAssignment":{"name":"Mandate and Audit Tags on Supported Resources}

[jayendranarumugam]

ref #17474

fyi, this issue is not occuring for Restore-AzSynapseSqlPool

e.g,

Restore-AzSynapseSqlPool -FromRestorePoint -RestorePoint $restorePoint.RestorePointCreationDate -TargetSqlPoolName $TargetSqlPoolName -ResourceGroupName $TargetResourceGroupName -WorkspaceName $TargetSynapseWorkspaceName -ResourceId $sourcesqlpooldatabaseId -PerformanceLevel $PerformanceLevel -Tag $tags

[dingmeng-xue]

@jayendranarumugam , it seems the message comes from policy setting. Please do below 2 steps and provide more information.
2. Enable debug log via $DebugPreference = "Continue"
3. Call Restore-AzSqlDatabase again and check the log.

You can see the request and response on PowerShell console. Please share the information to us.

[ghost]

Thank you for your feedback. This has been routed to the support team for assistance.

[jayendranarumugam]

Here you go @dingmeng-xue . If you see the PUT Request is missing to pass the Tag property from the powershell command

HTTP Method:
PUT

Absolute Uri:
https://management.azure.com/subscriptions/xxxx/resourceGroups/rg/providers/Microsoft.Sql/servers/xxxx/databases/itsynapsedb?api-version=2021-05-01-preview

Headers:
x-ms-client-request-id        : 4e0d3dc1-1f9a-488f-91e3-3edcb7145b9c
Accept-Language               : en-US

Body:
{
  "sku": {
    "name": "DW100c",
    "tier": "DataWarehouse"
  },
  "properties": {
    "createMode": "PointInTimeRestore",
    "restorePointInTime": "2022-06-08T18:08:16Z",
    "sourceResourceId": "/subscriptions/xxxcx/providers/Microsoft.Synapse/workspaces/synapsews01/sqlPools/synapsedb"
  },
  "location": "eastus2"
}

[jayendranarumugam]

Hi @dingmeng-xue , Is there any update on the issue ? We are currently unable to move forward with this bug. Is there any workaround for this ?

[navba-MSFT]

@jayendranarumugam Apologies for the late reply. Thanks for reaching out to us and reporting this issue. We are looking into this issue and we will provide an update.

[navba-MSFT]

@jayendranarumugam Could you please check and confirm if you have any Azure Policies configured in your subscription ? This error seems to be due to the Azure Policy which is blocking the resource creation due to incorrect tags.

Resource 'synapsedb' was disallowed by policy. Policy identifiers:
| '[{"policyAssignment":{"name":"Mandate and Audit Tags on Supported Resources}

[jayendranarumugam]

Yes we have a policy to prevent from resources that doesn't have any tags. That why we are trying to restore the db along with the tags however looks like the tags we are given is not pass through the API . As i put here #18435 (comment)

[navba-MSFT]

@jayendranarumugam Could you please confirm if you are using 3.10.0 version of the Az.SQL module ? If not, Could you please upgrade your Az.SQL module to this version and test again ? Awaiting your reply.

[navba-MSFT]

@jayendranarumugam I wanted to do quick follow-up to check if you had a chance to look at my above comment. Please let us know if you are facing the same issue after upgrading to 3.10.0 version of the Az.SQL module. Awaiting your reply.

[jayendranarumugam]

Yep will test this today and let you know

[jayendranarumugam]

@navba-MSFT I can see this was fixed with #18475 and working as expected now. Feel free to link/close this issue

[navba-MSFT]

@jayendranarumugam Thanks for getting back. We will now proceed with closure of this GitHub issue. If you need any further assistance on this issue in future, please feel free to reopen this thread. We would be happy to help.