BICEP Policy deployment on root level | Microsoft Azure | Page 1

civic ivy Mar 4, 2024, 5:45 PM

#

Hello there!

I am trying to automate the deployment of Sentinel alongside connectors, however I'm having hard time for Azure activity for the policy assignment part.

The issue is when I want to define the scope to the root management groups level instead of a subscription, based on what I am trying to write I will either an error saying there is no policy in Microsoft.Authorization (The resource type could not be found in the namespace 'Microsoft.Authorization' for api version '2023-04-01'. (Code:InvalidResourceType))or:

Code=InvalidTemplateDeployment; Message=The template deployment failed with error: 'Authorization failed for template resource 'PolicyAssignment' of type 'Microsoft.Resources/deployments'. The client '[email protected]' with object id '162ea20a-121b-42f3-ab55-2a0c0df9d102' does not have permission to perform action 'Microsoft.Resources/deployments/write' at scope '/providers/Microsoft.Resources/deployments/PolicyAssignment'.'.

I'm honestly out of idea, you can find what I wrote bellow (I tried many things, none worked):

@description('Assign policy for Azure Activity')
param policyAssignmentName string = 'Test-EntraID-logs-to-LAW'
param policyDefinitionID string = '/providers/Microsoft.Authorization/policyDefinitions/2465583e-4e78-4c15-b6be-a36cbc7c8b0f'
param policyDisplayName string = 'TEST03 Configure Azure Activity logs to stream to specified Log Analytics workspace'

@description('Name for the Log Analytics workspace used to aggregate data')
param workspaceName string

resource assignment 'Microsoft.Authorization/policyAssignments@2023-04-01' = {
  name: policyAssignmentName
  scope: tenant()
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    policyDefinitionId: policyDefinitionID
    description: 'Policy assignment to resource group scope created with Bicep file'
    displayName: policyDisplayName
    nonComplianceMessages: [
      {
        message: 'Non compliant.'
      }
    ]
    parameters: {
      logAnalytics: {
          value: workspaceName
      }
      effect: {
        value: 'DeployIfNotExists'
      }
      logsEnabled: {
        value: 'True'
      }
    }
  }

}


resource remediateTask 'Microsoft.PolicyInsights/remediations@2021-10-01' = {
  name: guid('Remediate', policyDefinitionID, subscription().id)
  scope: tenant()
  properties: {
    failureThreshold: {
      percentage: 1
    }
    resourceCount: 500
    policyAssignmentId: assignment.id
    parallelDeployments: 10
    resourceDiscoveryMode: 'ExistingNonCompliant'
  }
}```

Thanks!

#

Configure Azure Activity logs to stream to specified Log Analytics ...

Deploys the diagnostic settings for Azure Activity to stream subscriptions audit logs to a Log Analytics workspace to monitor subscription-level events

neon whale Mar 5, 2024, 8:29 AM

#

#

Are you trying to assign at the tenant root group or contoso level?

#

And are you positive you have Resource Policy Contributor privileges at the tenant root group

lucid dune Mar 5, 2024, 11:33 AM

#

you are recommended to assign at the contoso level

civic ivy Mar 5, 2024, 11:58 AM

#

Yup yup, but let me show you exactly what I'm trying to do but from the portal view (Give me a moment)

#

#

Then, I would create a new remediation task, again on the Tenant Root Group level

civic ivy Mar 5, 2024, 12:33 PM

#

BTW, after using the following: New-AzRoleAssignment -Scope '/' -RoleDefinitionName 'Owner' -ObjectId $user.Id
So putting myself as the owner I don't have the permission issue anymore, but still getting the following error:
New-AzResourceGroupDeployment: 6:47:47 PM - The deployment 'PolicyDeployment' failed with error(s). Showing 2 out of 2 error(s).
Status Message: The resource type could not be found in the namespace 'Microsoft.Authorization' for api version '2023-04-01'. (Code:InvalidResourceType)

Status Message: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details. (Code: DeploymentFailed)

The resource type could not be found in the namespace 'Microsoft.Authorization' for api version '2023-04-01'. (Code:InvalidResourceType)

I'm clearly misunderstanding something here

Deployment history - Azure Resource Manager

Describes how to view Azure Resource Manager deployment operations with the portal, PowerShell, Azure CLI, and REST API.

civic ivy Mar 5, 2024, 12:38 PM

#

neon whale And are you positive you have Resource Policy Contributor privileges at the tena...

And thanks for that point, I didn't pay attention to the difference there, I was indeed in the past only contributor & admin, and was lacking the Resource Policy Contributor :b I thought admin would mean everything at first but nop, still have to learn stuff there haha

neon whale Mar 5, 2024, 12:43 PM

#

civic ivy BTW, after using the following: New-AzRoleAssignment -Scope '/' -RoleDefinitionN...

Fill in your tenantid instead of /, TRG is not /, / is root

civic ivy Mar 5, 2024, 2:12 PM

#

yeeh, no more issue with the permission but I honestly don't know. I can deploy in the same subscription with no issue, but specifying the in Management group the tenant root group is a no

So the procedure from the Portal:

I select for the scope in the Management Group the tenant root Group
I select my workspace group for the LAW
I define the location to EUW and identiy to SystemAssigned

And that's all

why can't I with my bicep xd

I tried through a module but I will get he policy assignment 'xxxx-EntraID-logs-to-LAW' create request is invalid. Policy assignment scope '/providers/Microsoft.Management/managementGroups/xxxxxxx' must match the scope specified on the Uri '/subscriptions/dxxxxxxxxxxx/resourcegroups/rg_armtemplate76

civic ivy Mar 6, 2024, 4:06 PM

#

I managed to make it work using an az cli command calling a file. But that's when I'm doing on the side and I tried to include that in my main bicep code with a deployment script, however it's not behaving as intended.

param managementGroupId string
param workspaceId string
param location string

resource policyAssignmentAAD 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
  name: 'policyAssignmentAAD'
  location: location
  kind: 'AzureCLI'
  properties: {
    azCliVersion: '2.38.0'
    environmentVariables: [
      {
        name: 'MANAGEMENTGROUPID'
        value: managementGroupId
      }
      {
        name: 'WORKSPACEID'
        value: workspaceId
      }
      {
        name: 'LOCATION'
        value: location
      }
      {
        name: 'URL'
        value: 'https://githuproxy'
      }
    ]
    scriptContent: '''
    az deployment mg create --management-group-id $MANAGEMENTGROUPID --location $LOCATION --template-uri $URL --parameters workspaceID=$WORKSPACEID
    '''
    timeout: 'PT30M'
    cleanupPreference: 'OnSuccess'
    retentionInterval: 'PT1H'
  }
}

The template is stored in a private github repo that I reach using an Azure APP as a proxy, when doing locally I have no issue (for that command) thus not sure what I'm doing wrong here.
Note; The url is very long (284 char), not sure if that can affect in anyway because I need to put my proxy url then the raw github url

It will say the url is not reachable or something - Which is not true 😄

userscript.sh: line 4: https://githubproxyxxx: No such file or directory (Code: DeploymentScriptError)

#

Confirm me if I'm wrong, but I cannot call a local file inside a deploymentScript, right?

so az deployment mg create --location WestUS --management-group-id testmg --template-file azuredeploy.json

Won't be possible, correct?

sacred heart Mar 7, 2024, 9:27 PM

#

Do you have the proper role assignment on MG level?

#

Or try to validate first

#

az deployment mg validate --management-group-id testmg --location WestUS --template-file {template-file}

#

Also try to add

#

"scope: '${managementGroupId}'
// Additional properties can be added as needed scope: '${managementGroupId}'"

civic ivy Mar 8, 2024, 12:28 PM

#

I forgot to come back here, but I managed to make it work, in my previous message some characters in the url were not correctly encoded thus leading to the error

#BICEP Policy deployment on root level