fix: move Deny-Windows-Vm-HotPatch from Automation to Compute guardrails

[Pratyush Verma (pratyushverma63)]

Fix #4176 Move Deny-Windows-Vm-HotPatch out of the Automation guardrails initiative

Deny-Windows-Vm-HotPatch (built-in ID 6d02d2f7-e38b-4bdc-96f3-adc0a8726abc) and its autoHotPatch parameter were incorrectly placed in Enforce-Guardrails-Automation. This policy governs Windows VM automatic hotpatching and belongs in Enforce-Guardrails-Compute.

Because removing a parameter/policy from an initiative is a breaking change, this follows the established ALZ deprecation convention (as used by Enforce-EncryptTransit, Enforce-Guardrails-Network, Enforce-Guardrails-KeyVault): deprecate the old initiative and ship a new dated successor, rather than an in-place edit.

Changes

File	Change
Enforce-Guardrails-Automation.json	Deprecated - version: 1.1.0-deprecated, deprecated: true, supersededBy: Enforce-Guardrails-Automation_20260910, [Deprecated]: display name. Original content (incl. hotpatch) retained so existing assignments keep working.
Enforce-Guardrails-Automation_20260910.json	New successor - 5 Automation policies, no hotpatch, version: 1.0.0, replacesPolicy: Enforce-Guardrails-Automation.
Enforce-Guardrails-Compute.json	Hotpatch added (additive) - in-place 1.2.0.
initiatives.bicep	Loads both the deprecated and new dated Automation initiatives.
ENFORCE-GuardrailsAutomationPolicyAssignment.json	Repointed to Enforce-Guardrails-Automation_20260910.
initiatives.json	Regenerated from Bicep.

Why deprecate instead of in-place bump

An existing assignment that passes autoHotPatch would break if the parameter were removed in place. Keeping the deprecated initiative unchanged means current assignments continue to work; new deployments use the dated successor via the updated assignment. The policy definition itself is unchanged (same built-in ID), and hotpatch coverage is preserved because Compute is also assigned.

---

Testing proof

Static validation (all PASS):

DEPRECATED Automation (base)
  version == 1.1.0-deprecated                 PASS
  deprecated == true                          PASS
  supersededBy == _20260910                   PASS
  displayName has [Deprecated]                PASS
  STILL contains hotpatch (frozen)            PASS
NEW dated Automation
  name == Enforce-Guardrails-Automation_20260910  PASS
  version == 1.0.0                            PASS
  replacesPolicy == Enforce-Guardrails-Automation PASS
  NO hotpatch / autoHotPatch                  PASS
  has 5 policy references                     PASS
Compute (additive, in-place)
  version == 1.2.0                            PASS
  contains exactly one hotpatch ref           PASS
  has autoHotPatch parameter                  PASS
Assignment targets _20260910                  PASS
initiatives.json fresh build == checked-in    PASS
git diff --check clean                        PASS

Live deployment (subscription scope, verified):

Enforce-Guardrails-Compute              (v1.2.0, 3 refs)  - includes Deny-Windows-Vm-HotPatch
Enforce-Guardrails-Automation           (v1.1.0-deprecated [deprecated], 6 refs) - hotpatch retained (frozen)
Enforce-Guardrails-Automation_20260910  (v1.0.0, 5 refs)  - no hotpatch

Mirrors the CI checks in Test-BuildPolicies.Tests.ps1 (build parity) and Test-ModifiedPolicies.Tests.ps1 (metadata/version + deprecated-metadata).

Portal verification (deployed to a test subscription)

Reviewers can inspect the deployed initiatives via Policy -> Definitions (scope = test subscription, Definition type = Initiative):

• Enforce-Guardrails-Compute - Parameters shows autoHotPatch; policy list includes Deny-Windows-Vm-HotPatch.
• [Deprecated]: Enforce-Guardrails-Automation - marked deprecated, still contains hotpatch (frozen for back-compat).
• Enforce-Guardrails-Automation_20260910 - no hotpatch.

Follow-up

• After merge, sync to Azure/Azure-Landing-Zones-Library.
• Add the deprecation to the ALZ Deprecated Services page.

---

Related PRs

• Docs (deprecation notice): docs(policy): deprecation notice for Enforce-Guardrails-Automation (#4176) Azure-Landing-Zones#4264 adds the deprecation entry for Enforce-Guardrails-Automation on the ALZ deprecation notices page.

[Pratyush Verma (pratyushverma63)]

Thanks Qi Zhang (@Zhangqi910) - fixed the aaModifyLocalAUth -> aaModifyLocalAuth casing in both the deprecated Enforce-Guardrails-Automation and the successor Enforce-Guardrails-Automation_20260910 initiatives, and regenerated initiatives.json. Addressed in commit 641994e.