Need sample example to assign RBAC on different management groups in enterprise scale environment

[azureiac]

Hi Team,

I am looking for an approach to deploy RBAC using bicep file and parameters file on different management groups in enterprise scale.

The template should be idempotent .

Management groups examples

mg-landingzone
mg-sandbox
mg-platform
mg-connectivity

Please suggest best approach and sample example to deploy RBAC on management groups.

[StefanIvemo]

Converting this issue to discussion.

[StefanIvemo]

With the combination of the issue you posted yesterday about policy assignments to multiple management groups and now RBAC assignments, I would strongly advice to look into the AzOps repo. AzOps is a great way to manage your Enterprise-Scale Landing Zones using code.

[azureiac]

@StefanIvemo : Sure are there any good videos to see how azops setup in azure devops environment. And currently requirement is to deploy code through bicep that's why we are checking examples. I know in roadmap enterprise scale github will also release bicep templates in future.

[azureiac]

@StefanIvemo : Need help on the earlier topic which we were discussing with your code I am able proceed. The only part is now about deploy if not exist policy how can I integrate as it requires RBAC to assign..

policyassign.bicep

targetScope = 'managementGroup'

param assignments array

module policyAssignments 'testmod.bicep' = [for assignment in assignments: {
name: '${assignment.targetMG}-deploy'
scope: managementGroup(assignment.targetMG)
params: {
targetMG: assignment.targetMG
policies: assignment.policies
}
}]

module.bicep

targetScope = 'managementGroup'

@description('Target Management Group')
param targetMG string

@description('Management Group Policies')
param policies array

var mgScope = '/providers/Microsoft.Management/managementGroups/${targetMG}'

resource policyAssignment 'Microsoft.Authorization/policyAssignments@2020-03-01' = [for policy in policies: {
name: policy.name
location:'westeurope'
identity: policy.identity
properties: {
scope: mgScope
displayName : policy.displayName
policyDefinitionId: policy.policyDefinitionId
parameters: policy.parameters
enforcementMode: 'Default'
}
}]

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = [for policy in policies: {
name: guid(policy.name, 'Microsoft.Authorization/policyAssignments',mgScope)
properties: {
principalId: policy.principalId
roleDefinitionId: policy.roleDefinitionId
}
}]

parameters.json

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"assignments": {
"value": [
{
"targetMG": "mg-landingzone",
"policies": [
{
"name": "deploy-paas-dig",
"displayName": "Deploy Diagnostic Settings to Azure Services",
"policyDefinitionId": "/providers/Microsoft.Management/managementGroups/tenantid/providers/Microsoft.Authorization/policySetDefinitions/Deploy-Diagnostics-LogAnalytics",
"parameters": {
"logAnalytics": {
"value": "law-central"
}
},
"identity": {
"type": "SystemAssigned"
},
"roleDefinitionId": [
"/providers/microsoft.authorization/roleDefinitions/749f88d5-cbae-40b8-bcfc-e573ddc772fa",
"/providers/microsoft.authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293"
]
}
]

            }
        ]
    }
}

}

[brwilkinson]

@azureiac Are you still working on this one?

Let us know if there is any more guidance or discussion points to cover?

[brwilkinson]

Going to mark this as answered, however please feel free to open a new discussion or continue this one.