CODEWITHSUNDEEP
azureazure-active-directory
Ganesh Pol
Ganesh Pol

Reputation: 453

How to assign role to an Azure service principal from different subscription?

problem statement
currently, I am in the process to create/modify azure resources in the different subscription with the help of azure terraform.

error 

Principal <appid> does not exist in the directory {destination-tenant-id-for which contribution role required}

consider the following scenario.
we want to create Azure AKS cluster in one subscription and in same execution, we want to update DNS define in another subscription. this process works well if we are having both i.e. DNS zone and aks cluster in the same subscription but it will not work if these two resources in the different subscription.

steps taken
create service principal without assignment 

az ad sp create-for-rbac -n sp-terraform-001 --skip-assignment

assign contributor role for current sp for current subscription

az role assignment create --assignee <appid>  --role Contributor --scope /subscriptions/<sub-id>

*assign contributor role to current sp for a different subscription. it will fail with *

az role assignment create --assignee <appid>  --role Contributor --scope /subscriptions/<diff-sub-id>/<resource-group>....

please let me know correct steps to access resources in another subscriptions

Upvotes: 5

Views: 8347

Answers (1)

Sam Cogan
Sam Cogan

Reputation: 4324

You can assign rights to a service principal to multiple subscriptions, that is not an issue, as the SP sits outside of the subscription, it is in Azure AD.

However, you cannot assign rights to resources in a different Azure AD tenant to the one the service principal sits in, which it sounds like you are trying to do here.

Upvotes: 6

Related Questions