Cross ResourceGroup Role Assignment

[AsraFatima]

Can i Manage Access Control for other resource Groups using the Cross Resource Group Feature? I am try to assign permission to an Azure AD Application to another resource group and it fails with the error

Role Assignment to a different ResourceGroup
{
"code": "BadRequest",
"message": "{\r\n "error": {\r\n "code": "InvalidCreateRoleAssignmentRequest",\r\n "message": "The request to create role assignment '449aad68-15ee-49aa
-6871-ee449aad6871' is not valid. Role assignment scope '/subscriptions/xxxxxxx-xxxx-cxxxx-xxxxx-xxxxxxxxxxxx/resourceGroups/CitrixCustomImage' must match the scope specified on the
URI '/subscriptions/xxxxxxx-xxxx-cxxxx-xxxxx-xxxxxxxxxxxx/resourcegroups/CitrixInfraRG38'."\r\n }\r\n}"
}

[rjmax]

You will need to provision the role assignment via a nested deployment - not directly.

[johnmehler]

Can you give an example of provisioning via a nested deployment? I'm having a similar problem when trying to give permissions to a specific resource instead of an entire resource group.

[eriksteinebach]

Sorry for bringing up this old issue, but I am running into the same issue. I now introduced a nested deployment, but I still keep getting the same error. This is my template:

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "ResourceLocationName": {
      "type": "string",
      "defaultValue": "East US",
      "metadata": {
        "description": "Describes the resource location"
      }
    },
    "EventGridName": {
      "type": "string",
      "minLength": 1
    },
    "AuthorizedEnterpriseApplicationId": {
      "type": "string",
      "minLength": 1
    },
    "RoleAssignmentId": {
      "type": "string",
      "minLength": 1,
      "metadata": {
        "description": "Just a random unique generated GUID"
      }
    }
  },
  "resources": [
    {
      "apiVersion": "2018-01-01",
      "name": "[parameters('EventGridName')]",
      "type": "Microsoft.EventGrid/topics",
      "location": "[parameters('ResourceLocationName')]",
      "tags": {
        "displayName": "eventgrid"
      },
      "properties": {
        "name": "[parameters('EventGridName')]"
      }
    },
    {
      "apiVersion": "2017-05-10",
      "name": "nestedTemplate",
      "type": "Microsoft.Resources/deployments",
      "dependsOn": [ "[resourceId('Microsoft.EventGrid/topics', parameters('EventGridName'))]" ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": [
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "name": "[parameters('RoleAssignmentId')]",
              "apiVersion": "2017-10-01-preview",
              "location": "[parameters('ResourceLocationName')]",
              "properties": {
                "roleDefinitionId": "[concat(subscription().Id, '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c')]",
                "principalId": "[parameters('AuthorizedEnterpriseApplicationId')]",
                "scope": "[concat(subscription().id, '/resourcegroups/', resourceGroup().name, '/providers/Microsoft.EventGrid/topics/', parameters('EventGridName'))]"
              }
            }
          ]
        }
      }
    }
  ]
}

I can't find anything on why this is not working. Here they state it should be possible: https://github.com/uglide/azure-content/blob/master/articles/resource-manager-template-role.md

Scope:
/subscriptions/{subscription-id}/resourceGroups/{resource-group-name} (for resource groups) or
/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/{provider-namespace}/{resource-type}/{resource-name} (for resources)

Any idea what else I could try, or where I could upload a issue?

[jairov4]

Im having the same issue but I think the URL is having 'resourceGroups' and other one is having 'resourcegroups' may be the case is the issue?

[Kolbasz12]

Sorry for bringing up this old issue, but I am running into the same issue. I now introduced a nested deployment, but I still keep getting the same error. This is my template:

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "ResourceLocationName": {
      "type": "string",
      "defaultValue": "East US",
      "metadata": {
        "description": "Describes the resource location"
      }
    },
    "EventGridName": {
      "type": "string",
      "minLength": 1
    },
    "AuthorizedEnterpriseApplicationId": {
      "type": "string",
      "minLength": 1
    },
    "RoleAssignmentId": {
      "type": "string",
      "minLength": 1,
      "metadata": {
        "description": "Just a random unique generated GUID"
      }
    }
  },
  "resources": [
    {
      "apiVersion": "2018-01-01",
      "name": "[parameters('EventGridName')]",
      "type": "Microsoft.EventGrid/topics",
      "location": "[parameters('ResourceLocationName')]",
      "tags": {
        "displayName": "eventgrid"
      },
      "properties": {
        "name": "[parameters('EventGridName')]"
      }
    },
    {
      "apiVersion": "2017-05-10",
      "name": "nestedTemplate",
      "type": "Microsoft.Resources/deployments",
      "dependsOn": [ "[resourceId('Microsoft.EventGrid/topics', parameters('EventGridName'))]" ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": [
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "name": "[parameters('RoleAssignmentId')]",
              "apiVersion": "2017-10-01-preview",
              "location": "[parameters('ResourceLocationName')]",
              "properties": {
                "roleDefinitionId": "[concat(subscription().Id, '/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c')]",
                "principalId": "[parameters('AuthorizedEnterpriseApplicationId')]",
                "scope": "[concat(subscription().id, '/resourcegroups/', resourceGroup().name, '/providers/Microsoft.EventGrid/topics/', parameters('EventGridName'))]"
              }
            }
          ]
        }
      }
    }
  ]
}

I can't find anything on why this is not working. Here they state it should be possible: https://github.com/uglide/azure-content/blob/master/articles/resource-manager-template-role.md

Scope:
/subscriptions/{subscription-id}/resourceGroups/{resource-group-name} (for resource groups) or
/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/{provider-namespace}/{resource-type}/{resource-name} (for resources)

Any idea what else I could try, or where I could upload a issue?

Did you ever get this working?

[kalyanb9119]

Change the "type" to "Microsoft.EventGrid/topics/providers/roleAssignments" from "Microsoft.Authorization/roleAssignments". Then it should work.. Also change "name" to include the name of "Microsoft.EventGrid/topics" resource. and add dependency on this aswell.

Also to "scope" add '/subscriptions/' in concat..

[ohadschn]

https://stackoverflow.com/questions/52340455/apply-azure-rbac-to-a-resource-using-arm
https://www.henrybeen.nl/creating-an-authorization-rule-using-an-arm-template/