search

stgeorgi / wvdquickstart

26 stars 31 forks source link

Invoke-GeneralDeployment.ps1:76 #12

Open FallenHoot opened 4 years ago

FallenHoot commented 4 years ago

When running Empty Subscription it fails 100% at this step.

Issue: Performing the operation "Creating Deployment" on target "WVDDEMO". New-AzResourceGroupDeployment: /home/vsts/work/1/s/SharedDeploymentFunctions/Invoke-GeneralDeployment.ps1:76 Line 76 | New-AzResourceGroupDeployment @DeploymentInputs -Resource Error: Code=InvalidTemplateDeployment; Message=The template deployment failed with error: 'Authorization failed for template resource 'profiles1005t101022z/default/wvdprofiles/Microsoft.Authorization/65d15962-70b1-5e79-9a0d-47e9cad494fa' of type 'Microsoft.Storage/storageAccounts/fileServices/fileshares/providers/roleAssignments'. The client 'SERVICEACCOUNT' with object id 'SERVICEACCOUNT' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/WVDSUBSCRIPTION/resourceGroups/WVDDEMO/providers/Microsoft.Storage/storageAccounts/profiles1005t101022z/fileServices/default/fileshares/wvdprofiles/providers/Microsoft.Authorization/roleAssignments/65d15962-70b1-5e79-9a0d-47e9cad494fa'.'. [error]PowerShell exited with code '1'. Script Execution Complete

Fix: Remove anything that has to do with New-AzManagementGroupDeployment or ManagementGroupID. It is not created and if it was created, it should have a parameter. As it will fail each time.

justin-shiah commented 3 years ago

@FallenHoot Thanks for listing the fix, I will file a bug for this. Was the fix able to resolve all the issues you were facing?

stgeorgi commented 3 years ago

I think this error happens only if you rerun the arm template but we do not clean up the existing service principal prior to redoployng. My test so far (6+) on empty subs have no such probem