Question: multitenancy and ALZ Policies

[bozic]

Hello, I have searched over documentation but did not really see anywhere what to do in the case where I have 2 (or more) tenants (test and prod) and I want to deploy ALZ Policies - the problem I see is that Sync-ALZPolicies will create set of JSON files that need to be manually enriched with specific tenant data (management groups, log analyticis workspaces, private DNS zones IDs) and since this is tenant specific the deployment will fail for different tenant specified in global-settings.jsonc

I did not find how to make only this assignments json files tenant specific that will also work with update procedure. Is there any workaround for this issue, or do I need to have 2 completely separate projects?

Thanks, Eugen

[anwather]

Just duplicate the assignment files and you can have two sets of parameters. I would have a single global settings file with both tenants listed in there - then just use the - PacEnvironmentSelector parameter when you build and deploy. No need to maintain two separate projects.

The sync-alzpolicies command only pulls down the files, you can customise them any way you want.

Get Outlook for Androidhttps://aka.ms/AAb9ysg

---

From: bozic @.> Sent: Thursday, March 14, 2024 8:13:21 PM To: Azure/enterprise-azure-policy-as-code @.> Cc: Subscribed @.***> Subject: [Azure/enterprise-azure-policy-as-code] Question: multitenancy and ALZ Policies (Issue #508)

Hello, I have searched over documentation but did not really see anywhere what to do in the case where I have 2 (or more) tenants (test and prod) and I want to deploy ALZ Policies - the problem I see is that Sync-ALZPolicies will create set of JSON files that need to be manually enriched with specific tenant data (management groups, log analyticis workspaces, private DNS zones IDs) and since this is tenant specific the deployment will fail for different tenant specified in global-settings.jsonc

I did not find how to make only this assignments json files tenant specific that will also work with update procedure. Is there any workaround for this issue, or do I need to have 2 completely separate projects?

Thanks, Eugen

— Reply to this email directly, view it on GitHubhttps://github.com/Azure/enterprise-azure-policy-as-code/issues/508 or unsubscribehttps://github.com/notifications/unsubscribe-auth/ACWCJVWU6KHZGK4UGJ2R4O3YYFS3DBFKMF2HI4TJMJ2XIZLTSOBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJLJONZXKZNENZQW2ZNLORUHEZLBMRPXI6LQMWBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTLDTOVRGUZLDORPXI6LQMWSUS43TOVS2M5DPOBUWG44SQKSHI6LQMWVHEZLQN5ZWS5DPOJ42K5TBNR2WLKJTGM3TCNRSHAZTRAVEOR4XAZNFNFZXG5LFUV3GC3DVMWVDEMJYGU4DGOBQGUZKO5DSNFTWOZLSUZRXEZLBORSQ. You are receiving this email because you are subscribed to this thread.

Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

[bozic]

@anwather that is the question exactly :) Since pacEnvironments does not have any property to point to different folder for assignment, how to do it? Where do I specify the path of that new folder where I have custom policy assignment jsons per tenant? I can only specify full folder path for definitions by using definitionsRootFolder and that includes the assignment also , but I would want the same definitions and only different assignment.

[anwather]

In each assignment file is a scope entry where you specify the pac environment and the scope the assignment is being deployed to.

You would have two assignment files, each with different scope settings. You can leave them in the same folder, when the build runs it only processes assignment where the pac environment in the scope matches the -PacEnvironmentSelector.

You can always have different folders under the policy Assignments folder - they are ignored by the build process.

Policy definitions set definitions I just deploy to both tenants as it is the assignment which decides how and where the policy is deployed. I had a case where I was working with 5 tenants, still just used one repo but had folders underneath the policy assignments folder. Just use the scope in the assignment to assign to different pac environments.

Get Outlook for Androidhttps://aka.ms/AAb9ysg

---

From: bozic @.> Sent: Thursday, March 14, 2024 9:20:05 PM To: Azure/enterprise-azure-policy-as-code @.> Cc: Mention @.>; Comment @.>; Subscribed @.***> Subject: Re: [Azure/enterprise-azure-policy-as-code] Question: multitenancy and ALZ Policies (Issue #508)

@anwatherhttps://github.com/anwather that is the question exactly :) Since pacEnvironments does not have any property to point to different folder for assignment, how to do it? Where do I specify the path of that new folder where I have custom policy assignment jsons per tenant? I can only specify full folder path for definitions by using definitionsRootFolder and that includes the assignment also , but I would want the same definitions and only different assignment.

— Reply to this email directly, view it on GitHubhttps://github.com/Azure/enterprise-azure-policy-as-code/issues/508#issuecomment-1997106435 or unsubscribehttps://github.com/notifications/unsubscribe-auth/ACWCJVUUBOVMZWIPNQSHDNLYYF2VNBFKMF2HI4TJMJ2XIZLTSOBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLLDTOVRGUZLDORPXI6LQMWWES43TOVSUG33NNVSW45FGORXXA2LDOOJIFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVEZTGNZRGYZDQMZYQKSHI6LQMWSWS43TOVS2K5TBNR2WLKRSGE4DKOBTHAYDKMVHORZGSZ3HMVZKMY3SMVQXIZI. You are receiving this email because you were mentioned.

Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

[anwather]

Hope this makes sense I was typing on my phone :)

[bozic]

Hope this makes sense I was typing on my phone :)

I was missing the understanding of "when the build runs it only processes assignment where the pac environment in the scope matches the -PacEnvironmentSelector"

I will test it out, thx a bunch :)