"Microsoft.Maintenance/configurationAssignments" BICEP giving unexpected generic error suddenly withot code changes

[zenturash]

Describe the bug Hi team, previously I have been able to deploy dynamic scope for maintenance configuration using bicep templates, but within the last couple of weeks it stopped working without any code changes to the deployment scripts we have developed please look at this.

it just gives me a InternalServerError with the message "An error has occurred"

Related command

@description('Location of the Resource Group')
param location string

@description('rebootSetting: If a reboot is required after installation of updates')
param rebootSetting string

@description('Date plus one')
param currentDatePlusOne string

@description('Date plus one')
param dateTimeToStart string = '${currentDatePlusOne} 02:00'

@description('Sunday maintenance name')
param maintenanceNameSunday string

@description('Saturday maintenance name')
param maintenanceNameSaturday string

@description('duration of the maintenance window')
param maintenanceWindowduration string = '03:00'

@description('maintenance scope: InGuestPatch')
param maintenanceScope string

@description('maintenance time zone: Romance Standard Time')
param maintenanceTimeZone string

@description('patch day name: Saturday')
param patchDayNameSaturday string

@description('patch day name: Sunday')
param patchDayNameSunday string

@description(' in guest patch mode: User')
param inGuestPatchMode string

@description('Os types: Linux')
param osTypesLinux string

@description('Os types: Windows')
param osTypesWindows string

@description('resource types: virtualMachines')
param resourceTypesVm string

@description('resource types: ArcServers')
param resourceTypesArcServers string

@description('Search filter foreach dynamic group')
param filterOperator string

// === Saturday configuration ===
resource Saturday0200 'Microsoft.Maintenance/maintenanceConfigurations@2023-04-01' = {
name: maintenanceNameSaturday
location: location
properties: {
extensionProperties: {
InGuestPatchMode: inGuestPatchMode
}
installPatches: {
linuxParameters: {
classificationsToInclude: [
'Security'
'Critical'
]
}
rebootSetting: rebootSetting
windowsParameters: {
classificationsToInclude: [
'Critical'
'Security'
'UpdateRollup'
'FeaturePack'
'ServicePack'
'Definition'
'Tools'
'Updates'
]
excludeKbsRequiringReboot: false
}
}
maintenanceScope: maintenanceScope
maintenanceWindow: {
duration: maintenanceWindowduration
expirationDateTime: null
recurEvery: '1Week ${patchDayNameSaturday}'
startDateTime: dateTimeToStart
timeZone: maintenanceTimeZone
}
}
}

// === Sunday configuration ===
resource Sunday0200 'Microsoft.Maintenance/maintenanceConfigurations@2023-04-01' = {
name: maintenanceNameSunday
location: location
properties: {
extensionProperties: {
InGuestPatchMode: inGuestPatchMode
}
installPatches: {
linuxParameters: {
classificationsToInclude: [
'Security'
'Critical'
]
}
rebootSetting: rebootSetting
windowsParameters: {
classificationsToInclude: [
'Critical'
'Security'
'UpdateRollup'
'FeaturePack'
'ServicePack'
'Definition'
'Tools'
'Updates'
]
excludeKbsRequiringReboot: false
}
}
maintenanceScope: maintenanceScope
maintenanceWindow: {
duration: maintenanceWindowduration
expirationDateTime: null
recurEvery: '1Week ${patchDayNameSunday}'
startDateTime: dateTimeToStart
timeZone: maintenanceTimeZone
}
}
}

resource Saturday0200Group 'Microsoft.Maintenance/configurationAssignments@2023-04-01' = {
name: '${maintenanceNameSaturday}-filter'
properties: {
filter: {
osTypes: [
osTypesLinux
osTypesWindows
]
resourceTypes: [
resourceTypesVm
resourceTypesArcServers
]
tagSettings: {
filterOperator: filterOperator
tags: {
Patch: [
maintenanceNameSaturday
]
}
}
}
maintenanceConfigurationId: Saturday0200.id
}
}

resource Sunday0200Group 'Microsoft.Maintenance/configurationAssignments@2023-04-01' = {
name: '${maintenanceNameSunday}-filter'
properties: {
filter: {
osTypes: [
osTypesLinux
osTypesWindows
]
resourceTypes: [
resourceTypesVm
resourceTypesArcServers
]
tagSettings: {
filterOperator: filterOperator
tags: {
Patch: [
maintenanceNameSunday
]
}
}
}
maintenanceConfigurationId: Sunday0200.id
}
}

Errors { "status": "Failed", "error": { "message": "An error has occurred." } }

Issue script & Debug output { "status": "Failed", "error": { "message": "An error has occurred." } }

Expected behavior it should return status OK

Environment Summary azure-cli 2.57.0

core 2.57.0 telemetry 1.1.0

Dependencies: msal 1.26.0 azure-mgmt-resource 23.1.0b2

Bicep CLI version 0.25.53 (c0ad57dff6)

2.15.0 Microsoft.Graph.ChangeNotifications PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.DeviceManagement.E… PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Notes PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.CrossDeviceExperie… PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.DeviceManagement.F… PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Identity.Directory… PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Identity.Partner PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.SchemaExtensions PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.DeviceManagement.A… PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Bookings PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Authentication PSGallery Microsoft Graph PowerShell Authentication Module. 2.15.0 Microsoft.Graph.DeviceManagement.A… PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.DeviceManagement PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.CloudCommunications PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Mail PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Sites PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph PSGallery Microsoft Graph PowerShell module 6.15.1 Az.Resources PSGallery Microsoft Azure PowerShell - Azure Resource Manager and Active Directory cmdlets in Windows PowerShell and PowerShell Core. Manages subscriptions, tenants, resource groups, deployment templates, providers, and resource… 2.15.0 Microsoft.Graph.Calendar PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Compliance PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Identity.Governance PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Teams PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Reports PSGallery Microsoft Graph PowerShell Cmdlets 7.1.1 Az.Compute PSGallery Microsoft Azure PowerShell - Compute service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core. Manages virtual machines, hosted services, and related resources in Azure Resource Manager.… 2.15.0 Microsoft.Graph.People PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Users PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Applications PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Users.Actions PSGallery Microsoft Graph PowerShell Cmdlets 2.15.1 Az.Accounts PSGallery Microsoft Azure PowerShell - Accounts credential management cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core.… 2.15.0 Microsoft.Graph.Identity.SignIns PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Search PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Files PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Groups PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Users.Functions PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Devices.CloudPrint PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Education PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.DirectoryObjects PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Planner PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Devices.ServiceAnn… PSGallery Microsoft Graph PowerShell Cmdlets 7.4.0 Az.Network PSGallery Microsoft Azure PowerShell - Networking service cmdlets for Azure Resource Manager in Windows PowerShell and PowerShell Core.… 2.15.0 Microsoft.Graph.PersonalContacts PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Security PSGallery Microsoft Graph PowerShell Cmdlets 2.15.0 Microsoft.Graph.Devices.CorporateM… PSGallery Microsoft Graph PowerShell Cmdlets

Additional context No response

[jeskew]

@zenturash Does the deployment start and then fail to complete? If so, could you provide a correlation ID? That would allow us to pull up more detailed information about what happened with the deployment.

[zenturash]

well the deployment just hangs till it times out but you can look in the deployment and I get the error InternalServerError rigth away but it doesn't throw the deploymentbefor it times out. Correlation ID: 0da2579d-a76d-4f6d-b88e-fc28f9f822a9

seems like i'm not the only one since I can finde similar things being reported by people using the Az cli: https://github.com/Azure/azure-cli/issues/28415

[BartDecker]

@zenturash

aren't you missing the resourceId: 'string' property ?

I use the below excluding scope, and set the resourceId value to /subscriptions/xxxxd9a6a-xxxx-47e1-bbe5-6df00467a2e1 as the dynamic scope/configuration assignment for a maintenance configuration is a subscription deployment.

See also the discussion over here: https://learn.microsoft.com/en-us/answers/questions/1531243/error-bicep-deployment-of-maintenance-configuratio

resource symbolicname 'Microsoft.Maintenance/configurationAssignments@2023-04-01' = {
  name: 'string'
  location: 'string'
  scope: resourceSymbolicName << ditch this for use with a maintenance config
  properties: {
    filter: {
      locations: [
        'string'
      ]
      osTypes: [
        'string'
      ]
      resourceGroups: [
        'string'
      ]
      resourceTypes: [
        'string'
      ]
      tagSettings: {
        filterOperator: 'string'
        tags: {}
      }
    }
    maintenanceConfigurationId: 'string'
    resourceId: 'string'
  }
}

[zenturash]

@BartDecker

Well it hasn't been needed before I have deployment about 20 tenant the last month with the same code base with out any issues. Plus if you look at the ARM temale that azure it self uses to deploy that resource the only one in use is maintenanceConfigurationId param.

Here the Correlation ID : 12b2fc71-04e0-42b6-9cb1-897676debeee of the late tenant i deploy the same code on and it worked.

Here's a ID showing the ARM template Azure uses by default: b6fe3e27-5ac0-4120-a169-70769700d900

and the ARM temaple:

{
    "$schema": "http://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "resources": [
        {
            "type": "Microsoft.Maintenance/configurationAssignments",
            "apiVersion": "2023-04-01",
            "name": "Sun0200DynamicAssignment1",
            "properties": {
                "maintenanceConfigurationId": "/subscriptions/xxxxxxxx/resourceGroups/1027_Automation_Account/providers/Microsoft.Maintenance/maintenanceConfigurations/Sun0200",
                "filter": {
                    "resourceTypes": [
                        "microsoft.compute/virtualmachines",
                        "microsoft.hybridcompute/machines"
                    ],
                    "resourceGroups": [],
                    "osTypes": [
                        "Linux",
                        "Windows"
                    ],
                    "locations": [],
                    "tagSettings": {
                        "filterOperator": "All",
                        "tags": {
                            "Patch": [
                                ""
                            ]
                        }
                    }
                }
            }
        }
    ]
}

[zenturash]

But i'm gonna try adding that extra flag to the code base and try again. Just seems weird since the code base have worked before.

[BartDecker]

But i'm gonna try adding that extra flag to the code base and try again. Just seems weird since the code base have worked before.

Yeah let's see. I know I ran in the internal server error with a hanging deployment x times, trying to fix it x number of ways and it being fixed by adding the resourceId there with the value as described above and as outlined in the MS Q&A answer. I guess it will do the trick

Maybe you can ditch that resourceId when you use it together with the scope property in case you deploy it as an extension resource on a different resource. But in the case of a maintenance config it's needs to be deployed on the subscription.

[zenturash]

@BartDecker No change still getting InternalServerError, I tried it with the at the RG lvl and deploying it with a targetScope = 'subscription' aswell both getting InternalServerError Correlation ID with subscription targetScope 9b8cdee1-6d3c-40df-b93a-a7dd83e2bdda.

targetScope = 'subscription' 

@description('Sunday maintenance name')
param maintenanceNameSunday string

@description('Saturday maintenance name')
param maintenanceNameSaturday string

@description('Main resource group name')
param resourceGroupMaintenance string

@description('Os types: Linux')
param osTypesLinux string 

@description('Os types: Windows')
param osTypesWindows string 

@description('resource types: virtualMachines')
param resourceTypesVm string 

@description('resource types: ArcServers')
param resourceTypesArcServers string 

@description('Search filter foreach dynamic group')
param filterOperator string 

param subscriptionId string = subscription().id

// ===== Findes existing maintenanceConfigurations for Sunday =====
resource Sunday0200 'Microsoft.Maintenance/maintenanceConfigurations@2023-04-01' existing  = {
  scope: resourceGroup(resourceGroupMaintenance)
  name: maintenanceNameSunday
}

// ===== Findes existing maintenanceConfigurations for Saturday =====
resource Saturday0200 'Microsoft.Maintenance/maintenanceConfigurations@2023-04-01' existing  = {
  scope: resourceGroup(resourceGroupMaintenance)
  name: maintenanceNameSaturday
}

resource Saturday0200Group 'Microsoft.Maintenance/configurationAssignments@2023-04-01' = {
  name: '${maintenanceNameSaturday}Group'
  properties: {
    filter: {
      osTypes: [
        osTypesLinux
        osTypesWindows
      ]
      resourceTypes: [
        resourceTypesVm
        resourceTypesArcServers
      ]
      tagSettings: {
        filterOperator: filterOperator
        tags: {
          Patch: [
            maintenanceNameSaturday
          ]
        }
      }
    }
    maintenanceConfigurationId: Saturday0200.id
    resourceId: subscriptionId
  }
  dependsOn: [
    Saturday0200
  ]
}

resource Sunday0200Group 'Microsoft.Maintenance/configurationAssignments@2023-04-01' = {
  name: '${maintenanceNameSunday}Group'
  properties: {
    filter: {
      osTypes: [
        osTypesLinux
        osTypesWindows
      ]
      resourceTypes: [
        resourceTypesVm
        resourceTypesArcServers
      ]
      tagSettings: {
        filterOperator: filterOperator
        tags: {
          Patch: [
            maintenanceNameSunday
          ]
        }
      }
    }
    maintenanceConfigurationId: Sunday0200.id
    resourceId: subscriptionId
  }
  dependsOn: [
    Sunday0200
  ]
}

[BartDecker]

Checkout the full comments in: https://learn.microsoft.com/en-us/answers/questions/1531243/error-bicep-deployment-of-maintenance-configuratio

Discussion is a bit hard to follow in the above Q&A to be honest. So no code example in itself is the correct one in that discussion

param subscriptionId string = subscription().subscriptionId for the subid not subscription().id

The value needs to reflect /subscriptions/xxxxd9a6a-xxxx-47e1-bbe5-6df00467a2e1 not only the id

Or just for testing hardcode /subscriptions/xxxxd9a6a-xxxx-47e1-bbe5-6df00467a2e1 as a value atm

without using scope.

It's also needed to work with a parent/child module if you are also deploying the maintenance config in the same bicep file. Both deployments happen in a different deployment scope so you can't mix them in 1 template.

Just one main template to deploy the maintenance config (rg scope deployment), calling a child which deploys the configuration assignment (subscription scope deployment)

so the above will only work with "existing":. But I see that is your usecase, so should be good.

[zenturash]

That basically what my original codebase was before trying to fix the issues when i tried to base it in to one undermodul handeling the entire maintenance deployment flow but I have restore my old main branch from 4 weeks ago(From whre it worked last time and stoppen working like 2 ish weeks ago) and is adding resourceId subscription().subscriptionId.

for refance I have a main deployment.BICEP file that calles 2 child moduls one deploying Microsoft.Maintenance/maintenanceConfigurations with a SCOPE on a RG and another modul deploying the Microsoft.Maintenance/configurationAssignments on a sub lvl

[BartDecker]

Can you make a screenshot of the deployment inputs as shown in the portal deployment?

I work with the flow now on a daily basis, seen all variations. Currently facing no problems with it. Will compare inputs with my successful runs

[zenturash]

I have tired 2 deployments one with the SubID only and one with /subscriptions/xxxxd9a6a-xxxx formating no luck

[zenturash]

I just checked accessed one on the tenant whre i deployed my original code bsed on I still have access to it was deployed on the 5th of January 2024 with Correlation ID: 12b2fc71-04e0-42b6-9cb1-897676debeee : Main Bicep file Config modul:

configurationAssignments

Inputs on maintenanceConfigurations:

Inputs on configurationAssignments:

[BartDecker]

Maybe add it to the Q&A as well and loop the MVP who answered my question there. He was fast in his replies. I see you do it a bit different then me (scope / subid). My config/code is 2 weeks old for your reference.

[zenturash]

@BartDecker Thanks for you input, just an update I went back to basics and hardcoded everything in a test configurationAssignments got that to work and worked from there, I have it working again.

[stephaniezyen]

Closing as it looks like Bart's fix worked, thank you! Please reopen if there is something else we need to address.