Export-AzRuleData fails with HTTP 400 for DefenderForStorageSettings due to deprecated API version

[PixelRobots]

When running Export-AzRuleData, the following warning is emitted for every storage account in a subscription:

WARNING: Failed to get '.../Microsoft.Security/DefenderForStorageSettings
  ?api-version=2022-12-01-preview': status=400
{"error":{"code":"UnsupportedApiVersion","message":"The HTTP resource ... 
does not support the API version '2022-12-01-preview'."}}

Root cause:

https://github.com/Azure/PSRule.Rules.Azure/tree/main/src/PSRule.Rules.Azure/Pipeline/Export/ResourceExpandVisitor.cs hardcodes "2022-12-01-preview" for the DefenderForStorageSettings sub-resource fetch:

AddSubResource(resource, await GetSubResourcesByProvider(
    context, resourceId,
    PROVIDER_TYPE_DEFENDER_FOR_STORAGE_SETTINGS,
    "2022-12-01-preview",   // deprecated
    ignoreNotFound: true));

Microsoft has since retired this preview version on the regional Defender for Storage endpoint (*.storageav.azure.com). The repo's own data/providers/microsoft.security/types.json already lists 2024-08-01-preview as the current version.

Suggested fix: Update the hardcoded version in https://github.com/Azure/PSRule.Rules.Azure/tree/main/src/PSRule.Rules.Azure/Pipeline/Export/ResourceExpandVisitor.cs from "2022-12-01-preview" to "2024-08-01-preview".

Environment: PSRule.Rules.Azure v1.47.0, Az.Accounts v5.5.1

[sary8]

I'd like to take this one.

I checked what the provider accepts today with az rest against a storage account in my subscription.

• The collection GET that ResourceExpandVisitor.cs line 564 uses, .../providers/Microsoft.Security/DefenderForStorageSettings?api-version=<v>, returns UnsupportedApiVersion for 2022-12-01-preview, 2024-08-01-preview, 2024-10-01-preview, 2025-01-01, 2025-02-01-preview, 2025-06-01 and 2025-07-01-preview. It returns 200 with { "value": [ ... ] } for 2025-09-01-preview, 2026-01-01-preview and 2026-03-01-preview.
• .../DefenderForStorageSettings/current?api-version=<v> returns 200 for every one of those versions, 2022-12-01-preview included.

So 2024-08-01-preview from the issue fails the same way, and so do the GA versions. The REST spec agrees: the collection path first appears in 2025-09-01-preview (https://github.com/Azure/azure-rest-api-specs/blob/main/specification/security/resource-manager/Microsoft.Security/Security/preview/2025-09-01-preview/defenderForStorageSettings.json), and 2025-01-01 / 2025-06-01 only define the {settingName} path.

The properties are unchanged (isEnabled, malwareScanning.onUpload.isEnabled, sensitiveDataDiscovery.isEnabled), so the three rules in Azure.Storage.Rule.ps1 that read them keep working.

I'd bump the version on that line to 2025-09-01-preview and keep the list call with ignoreNotFound: true. One line plus a changelog entry. Moving to a GA version with GET .../current is possible too, but single GETs have no ignoreNotFound path today, and /current returns the inherited defaults for accounts that currently export nothing, which could change Azure.Storage.DefenderCloud results for some users.

Could you assign this to me?