AZURE blueprint Custom Role

[pattisanta]

Hi ,
I created a blueprint custom role. I applied to the root MG . Looks like the heritance is showing. We can create BP and Delete however, we can not assign the BP to the subscription.
here is an example of the bicep.

targetScope = 'managementGroup'

@description('Array of actions for the roleDefinition')
param actions array = [
  'Microsoft.Blueprint/blueprints/write'
  'Microsoft.Blueprint/blueprints/artifacts/write'
  'Microsoft.Blueprint/blueprints/versions/write'
  'Microsoft.Blueprint/blueprints/delete'
  'Microsoft.Blueprint/blueprints/artifacts/delete'
  'Microsoft.Blueprint/blueprints/versions/delete'
  'Microsoft.Blueprint/blueprintAssignments/write'
  'Microsoft.Blueprint/blueprintAssignments/delete'
]

@description('Array of notActions for the roleDefinition')
param notActions array = []

@description('Friendly name of the role definition')
param roleName string = 'TFA-BluePrint-Creator'

@description('Detailed description of the role definition')
param roleDescription string = 'Subscription Level Deployment of a Role Definition'

var roleDefName = guid(managementGroup().id, string(actions), string(notActions))

resource roleDef 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' = {
  name: roleDefName
  properties: {
    roleName: roleName
    description: roleDescription
    type: 'customRole'
    permissions: [
      {
        actions: actions
        notActions: notActions
      }
    ]
    assignableScopes: [
      '/providers/Microsoft.Management/managementGroups/xxxxx'
    ]
  }
}

Thanks,
Patti

[alex-frankel]

Can you clarify how you confirmed inheritance is working as expected? And can you share the error you got when you attempted the blueprint assignment?

We also have built-in blueprint operator and blueprint contributor custom roles. Not sure if those are helpful or not.

[pattisanta]

Hi Alex, I hope you are well. I probably should have closed this. I realized this isn’t bicep issue. It more of why this role isn’t working. I created a custom role because, to assign blueprints owner role is required on the subscription. I look into the roles you mentioned. However, those don’t allow to assign new blueprints assignments only update existing one. When I apply custom role to the MG I can see the custom role on the subscription/s. Regards, Patti From: Alex Frankel ***@***.***> Sent: Friday, February 18, 2022 2:17 PM To: Azure/bicep ***@***.***> Cc: Santacroce, Patti ***@***.***>; Author ***@***.***> Subject: Re: [Azure/bicep] AZURE blueprint Custom Role (Discussion #5872) Can you clarify how you confirmed inheritance is working as expected? And can you share the error you got when you attempted the blueprint assignment? We also have built-in blueprint operator<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Frole-based-access-control%2Fbuilt-in-roles%23blueprint-operator&data=04%7C01%7Cpatti.santacroce%40teachforamerica.org%7Ccb98247fb3a144b6cfc008d9f313350f%7Ce1b9b06cef30491886545a7b9c1aca93%7C0%7C0%7C637808086096257492%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=x368k6IxuGKsun%2FVFMrjjbTIVKXx747O79bUKhcaHus%3D&reserved=0> and blueprint contributor<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fazure%2Frole-based-access-control%2Fbuilt-in-roles%23blueprint-contributor&data=04%7C01%7Cpatti.santacroce%40teachforamerica.org%7Ccb98247fb3a144b6cfc008d9f313350f%7Ce1b9b06cef30491886545a7b9c1aca93%7C0%7C0%7C637808086096257492%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=AnIAKpfsBPJ0%2FmIBLWPet4ij%2FGA19l%2FZNNPtP3ffnns%3D&reserved=0> custom roles. Not sure if those are helpful or not. — Reply to this email directly, view it on GitHub<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2Fbicep%2Fdiscussions%2F5872%23discussioncomment-2206982&data=04%7C01%7Cpatti.santacroce%40teachforamerica.org%7Ccb98247fb3a144b6cfc008d9f313350f%7Ce1b9b06cef30491886545a7b9c1aca93%7C0%7C0%7C637808086096257492%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=%2F4xZxFvNEHhNcpRmpKS%2F8gRteKG%2BcQQxOhZogvhr0Tc%3D&reserved=0>, or unsubscribe<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAECGXABRT54LUZPX2WTCK2TU32LJ5ANCNFSM5NR7ZSFA&data=04%7C01%7Cpatti.santacroce%40teachforamerica.org%7Ccb98247fb3a144b6cfc008d9f313350f%7Ce1b9b06cef30491886545a7b9c1aca93%7C0%7C0%7C637808086096257492%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=taIZnASgUqwR%2BgM9IAh%2BZtzYXXGRyolSJYHPtPz5swo%3D&reserved=0>. Triage notifications on the go with GitHub Mobile for iOS<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fapp%2Fapple-store%2Fid1477376905%3Fct%3Dnotification-email%26mt%3D8%26pt%3D524675&data=04%7C01%7Cpatti.santacroce%40teachforamerica.org%7Ccb98247fb3a144b6cfc008d9f313350f%7Ce1b9b06cef30491886545a7b9c1aca93%7C0%7C0%7C637808086096257492%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=0HLJTlm0tHulodzXQ3owmZXbwwfom%2BEbVj1jke7aWkE%3D&reserved=0> or Android<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.github.android%26referrer%3Dutm_campaign%253Dnotification-email%2526utm_medium%253Demail%2526utm_source%253Dgithub&data=04%7C01%7Cpatti.santacroce%40teachforamerica.org%7Ccb98247fb3a144b6cfc008d9f313350f%7Ce1b9b06cef30491886545a7b9c1aca93%7C0%7C0%7C637808086096257492%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=8HYd1AGhTKRyHoXU6XsILEjeNdEcu6LPdikZ0ecacHE%3D&reserved=0>. You are receiving this because you authored the thread.Message ID: ***@***.******@***.***>> [External Email: This message has originated from an external source. Please use proper judgment and caution when opening attachments, clicking links, or responding to this email.] ​