BluePrint on Management Group

Mukesh Bhakar 36

I am trying to apply one policy to lock all recovery service vaults using azure blueprint on the Tenant Root Group. I am the owner of the group but still, it says below-

You require additional permissions to manage blueprints within this management group. Contact the administrator of the management group to request Contributor rights.

My Target to stop delete lock from subscription owners.

1 answer

SadiqhAhmed-MSFT 37,846 Reputation points Microsoft Employee

2021-07-20T16:51:32.597+00:00

@Mukesh Bhakar - Thank you for your post and I apologize for the delayed response!

What is the context where you are seeing this error? How are you attempting to deploy the blueprint? How are you confirming that you are an owner of the management group (MG)?

For what its worth, blueprints can only deploy resources to a single subscription at a time. If you want to apply a policy to all subs under a particular MG, that will require a blueprint assignment per sub. We allow you to store the blueprint assignment resource at an MG, but only to prevent a subscription owner from removing the blueprint assignment (and the lock associated with it). If the blueprint only has policies, then I’d recommend assigning the policy directly to the MG.

---------------------------------------------------------------------------------------------------------------

If the response helped, do "Accept Answer" and up-vote it.
Please sign in to rate this answer.

1 person found this answer helpful.
Mukesh Bhakar 36 Reputation points

2021-07-21T06:57:04.24+00:00

Thanks for revert, My Target is to prevent subscription owners to stop or deleting locks. I was able to figure out that but now the issue is subscription owner can delete the blueprints that are assigned to a particular subscription. Is there any possibility that I can prevent subscription owner delete blueprint as well ?

SadiqhAhmed-MSFT 37,846 Reputation points Microsoft Employee

2021-07-27T07:32:05.077+00:00

@Mukesh Bhakar Yes, creating the blueprint assignment at the MG scope instead of the subscription scope – described here.

We allow you to store the blueprint assignment resource at an MG, but only to prevent a subscription owner from removing the blueprint assignment (and the lock associated with it)

You need to assign via PowerShell/cli in order to take advantage of this. It is not possible in the portal.

---------------------------------------------------------------------------------------------------------------

If the response helped, do "Accept Answer" and up-vote it.

Mukesh Bhakar 36 Reputation points

2021-07-27T11:14:15.4+00:00

Could you please share as I am not able to deploy it and the link not able to access that you mentioned?

I really appreciate it if you provide me Powershell or CLI steps to configure this

Mukesh Bhakar 36 Reputation points

2021-07-28T14:09:37.023+00:00

Hi

Appreciate your feedback on this,

SadiqhAhmed-MSFT 37,846 Reputation points Microsoft Employee

2021-07-30T19:30:10.097+00:00

@Mukesh Bhakar Here is the PowerShell command. It does not account for any parameters you need to pass:

$bp = Get-AzBlueprint -Name <BLUEPRINT_NAME> -Version 1.0 New-AzBlueprintAssignment -Blueprint $bp -Name foobar -SystemAssignedIdentity -Location eastus -ManagementGroupId <MG_ID> -Lock None -SubscriptionId <SUBSCRIPTION_GUID>

---------------------------------------------------------------------------------------------------------------

If the response helped, do "Accept Answer" and up-vote it.

Mukesh Bhakar 36 Reputation points

2021-08-03T10:47:48.1+00:00

Thanks for this but still I don't know why but this didn't work perfectly. Do I need to do this on already created blueprint or need to create blueprint.

SadiqhAhmed-MSFT 37,846 Reputation points Microsoft Employee

2021-08-04T05:43:05.68+00:00

@Mukesh Bhakar You can’t change a blueprint assignment from Sub scope to MG scope, so you would need to create a new blueprint assignment. Can you share what errors you are hitting and the code you are using to reproduce the issue?
Sign in to comment