CODEWITHSUNDEEP
azure-bicep
JSimcox
JSimcox

Reputation: 1

Azure Bicep - Unable to create a Management Group

I am in the process of trying to learn Bicep, as a part of that self-instruction I have been trying unsuccessfully to create a management group hierarchy. I am attempting to create a single management group using the following but am getting an error message when I deploy the bicep file.

targetScope = 'tenant'
param mgName string = 'test-displayname'
resource mgmtGroup 'Microsoft.Management/managementGroups@2021-04-01' = {
  name: mgName
}

When I attempt to deploy I get the following error message:

"Deployment failed for c:\bicep\Management Groups\azuredeploy.bicep. Tenant scope deployment is not currently supported."

I have tried changing API versions, deploying to the management group scope, etc. all with no success.

Any ideas are greatly appreciated!

Thanks

Upvotes: 0

Views: 778

Answers (2)

bmoore-msft
bmoore-msft

Reputation: 8717

I think you may be running into a few different issues.

  1. How are you deploying the template? The error you posted doesn't sound like it's coming from the service but the client...

  2. Your bicep file is targeting the tenant scope, for that you need permission to create template deployments at tenant scope (even if you create no resources). The principal deploying the template will need permission (contributor at least, owner is not required) at the tenant scope as Wesley mentioned. The thing to be aware of here is that this gives that principal contributor access to everything in the tenant - all MGs, All subs, All RGs. It's very permissive and needs to be used carefully/sparingly. Also, note that you do not need to target the tenant scope to create the MG in a template. You can set the targetScope in bicep to a RG, Sub or MG. But the principal deploying the template must have permission at whatever scope you target the bicep file to.

  3. A principal need not be given any special permission to simply create a MG - all users have this permission. You can test this by creating an MG on the cmd line. When that user creates the MG, the user is made the "owner" of that MG.

Point being, be very careful about granting perms at the tenant level and use only when necessary.

All that said, if your goal is to create MGs and deploy resources to those MGs in the same bicep deployment, the best path is to give the principal permissions (contributor is best) at the tenant level. Otherwise you will run into replication delays with permissions on the newly created MGs.

HTH

Upvotes: 0

Wesley Camargo
Wesley Camargo

Reputation: 66

By default, the SPN does not have permission to deploy tenant resources. You need to grant it at the root scope "/" to make it work.

First, you need to elevate your permissions as user Global Administrator into Azure AD: https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin

Connect-AzAccount

$user = Get-AzADUser -SignedIn

New-AzRoleAssignment -Scope '/' -RoleDefinitionName 'Owner' -ObjectId $user.Id

Now you are able to set your SPN with the correct permissions: https://github.com/Azure/Enterprise-Scale/blob/main/docs/EnterpriseScale-Setup-azure.md

$spndisplayname = "<SPN Display Name>"
$spn = (Get-AzADServicePrincipal -DisplayName $spndisplayname).id
New-AzRoleAssignment -Scope '/' -RoleDefinitionName 'Owner' -ObjectId $spn

enter image description here

Upvotes: 0

Related Questions