Anyone here who is an expert with Azure Blueprints?

[fickle prawn]

Hi, has anyone worked with Azure BPs? I haven't found my use-case in Azure docs. Use-case: There are existing resources like RG and other resources in it which have been deployed manually. Is it possible to create a blueprint definition and assign it to existing resources (RG and resources in it) and link them to the assigned blueprint to make them maintained by the bp?

[fickle prawn]

I did various tests now and existing resources are being linked

[elfin cipher]

Hi PSbob, how are you? i saw that you are practicing blueprints. How did you practise? with wich environment? Have you created two or more subscriptions? and how many management groups in your tenant?

[floral berry]

azure blueprints is in preview forever, I have a feeling it will be EOL before ever be GA

[elfin cipher]

hahahaha yes, it is in PREVIEW... and i want to tell you something... i took the AZ-305 exam and it had to many questions about BLUEPRINT hahaha.... i dont know if it would be in EOL.

[floral berry]

I have seen it also in sc-100 not long ago, but it's in preview since 2018:
https://azure.microsoft.com/en-us/updates/azure-blueprints-in-public-preview/
( and I'm busy getting rid of it... )

[fickle prawn]

yea sadly still in preview and doesn't get much attention/acceptance. But I think it's a nice to have feature especially when trying to make use of deny assignments which is currently not possible without using blueprints
@elfin cipher I'm good hbu? For my case I used my own subscription to practice with bp as there are practically zero costs for specific resources (RGs, NSGs etc.)

[floral berry]

deny assignments? what do you mean by that?

[fickle prawn]

https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments its a method to exclude owner permission to access resources

[elfin cipher]

mmmm i think the difference between azure policy and azure blueprint is that BluePrints remain connected to the deployed resources. You finally end up understanding the main concept of blueprint? You can create resources and assign policys to a entired tenant or individual subscriptions

[floral berry]

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#denyaction-preview

This is fairly new ( and preview ) to have deny actions higher than subscription level that can prevent owners from, let's say deleting locks

not sure why would you want to exclude owner to have permission to accessing resources, as that's it is his/her primary concept of having

[fickle prawn]

you should stop mixing up Az policies and Az blueprints. Some companies don't want the owner to be responsible for specific resources or resources in RGs. Teams should manage those resources while not having owner rights. So the concept is used to shift responsibility from subscription owner to dedicated teams with for example contributor rights. Its always the easiest way to ask the owner to do anything 🙂 thats why we want to lock this and have teams to manage their resources on their own. Policy => Compliance; Blueprint => I'd say resource health / lock / deny assignments
edit: I got this working so if anyone needs support regarding blueprints hit me up

[floral berry]

that's why Owner ( subscription admin ) is in most case recommended to be an NPA ( Non personel account ). Owner/contributor/User admin as a permission within Azure is something you elevate to using PIM, and nobody should have Owner permissions by default/all the time.

going with your examples PIM can be configured for the teams on their designated RGs, and they can elevate to the right level when they need to carry out certain actions

[fickle prawn]

yea I get your point but I do deployment with CI/CD in Azure DevOps and the user requesting the subscription (running pipeline) will be set as owner (automation app also) even when he doesn't deploy anything. PIM is not an option as far as I know someone needs to approve it

[floral berry]

it depends how you configure it, you can configure PIM for self-approval too

what happens to the subscription admin if the person leaves? you change it?

[elfin cipher]

mmm i think the only person who can have the owner is the @potent hazelain.onmicrosoft.com account... the other: Contributor...

[fickle prawn]

Subscription admin ≠ owner rbac

[fickle prawn]

this is not correct ^^I could invite you into my tenant and grant you owner permission

[elfin cipher]

yes, obviously.. you can invite me with owner... but can i remove anything? Or you just invite me with owner for some Resource groups?

technically, microsoft advisor will say: "STOP, you have more than 3 owners in your subscription" hehe

[floral berry]

I'm well aware of that, that's why I'm saying it should be NPA

[floral berry]

yup. Would also say use security groups instead of individual accounts.
I would say should only have break/glass admin accounts as owner, everything else should be behind PAM/PIM

[floral berry]

you got me thinking with this one, but looks like there isn't such limitation - however there are some others around the onmicrosoft.com domain:
https://learn.microsoft.com/en-us/microsoft-365/admin/setup/domains-faq?view=o365-worldwide#why-do-i-have-an--onmicrosoft-com--domain

[elfin cipher]

hahahaha nice... i think that this is not a limitation.. only good practise. Microsoft advisor will advise you, i think. I will read your article 😉