search

Azure / Azure-Lighthouse-samples

Provide samples for understanding managed service solutions
MIT License
295 stars 296 forks source link

whether "authorization" parameter in the ARM template is necessary or not #121

Open AmberYangY opened 2 years ago

AmberYangY commented 2 years ago

Hi all,

I tried to use the following template to assign authorizations to the roles. https://github.com/Azure/Azure-Lighthouse-samples/blob/master/templates/delegated-resource-management-eligible-authorizations/rg/rg.parameters.json I do not want to have the permanent role assignments for any principle and I only want to assign the PIM for principles.

I tried to delete "authorization" parameters both in the ARM template and parameter file. I only kept and configured the "eligibleAuthorizations" part which set up the PIM values. I deployed this ARM template and the following error came out.

{ "code": "DeploymentFailed", "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.", "details": [ { "code": "InvalidTemplate", "message": "Unable to process template language expressions for resource '/subscriptions/xxxx/providers/Microsoft.ManagedServices/registrationDefinitions/xxxxx' at line '71' and column '9'. 'The template parameter 'authorizations' is not found. Please see https://aka.ms/arm-template/#parameters for usage details.'" } ] }

May I ask whether this "authorization" is required and the necessary reason? Is it possible to only use the PIM in this template?

Thanks in advance!