|
| 1 | +# Lighhouse Subscription Management with EPAC |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +While EPAC is not currently able to handle all use cases for lighthouse integration, there are twe specific use cases requested through GH issues that have been accounted for. The following is offered as guidance around those use cases. It is possible that the work done to account for these use cases does allow for other, untested, functionality; so trying different permutations of below mentioned pacEnv settings may result in additional, undocumented functionality. |
| 6 | + |
| 7 | +## Use-case 1: Additional role assignment from managing tenant to managed subscriptions |
| 8 | + |
| 9 | +There are some instances where you may need to make additional role assignments to managed subscriptions while assigning policy at your managing tenant. The guidance below will cover a specific use case and all EPAC configurations necessary to achieve this use case. |
| 10 | + |
| 11 | +### Use-case |
| 12 | + |
| 13 | +When assigning Deploy Diagnostics Settings type policies at a scope in your managing tenant, you want to write the diagnostics data to a managed (lighhouse joined) subscription. |
| 14 | + |
| 15 | +### Configurations |
| 16 | + |
| 17 | +1. pacSelector Configuration. |
| 18 | + |
| 19 | +In your global settings file find the specific pagEnvironments that will have diagnostic settings policy deployed to them where the diagnostics data needs to be written to lighthouse managed subscription. Add the following to that pacSelector in the global settings file: |
| 20 | + |
| 21 | + "managedTenant": { |
| 22 | + "managedTenantId": "00000000-1111-2222-3333-444444444444", |
| 23 | + "managedTenantScopes": [ |
| 24 | + "/subscriptions/00000000-1111-2222-3333-444444444444", |
| 25 | + "/subscriptions/00000000-1111-2222-3333-444444444444" |
| 26 | + ] |
| 27 | + }, |
| 28 | + |
| 29 | +managedTenantId - The tenant containing the lighthouse managed (joined) subsciptions. |
| 30 | +managedTenantScopes - A list of all subscriptions that may need "remote" role assignments made to them. These would be the subscriptions that contain, for example, the Log Analytics Workspace or Storage Account that your are writing diagnostics data to across tenants. Every subscription where this pacEnvironment may need to make a role assignment to must be listed. |
| 31 | + |
| 32 | +1. In the assignment file add an additionalRoleAssignments section for the file or node so that the assignment knows that for assigning this policy, at this (managing) pacEnvironment, it needs to perform and additional role assignment at the remote (managed) scope. The scope of the assignment must be included in the managedTenantScopes for the pacEnvironment in the globalSettings file. |
| 33 | + |
| 34 | + "additionalRoleAssignments": { |
| 35 | + "managingTenantScopeEnv": [ |
| 36 | + { |
| 37 | + "roleDefinitionId": "/providers/microsoft.authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7", |
| 38 | + "scope": "/subscriptions/00000000-1111-2222-3333-444444444444", |
| 39 | + "crossTenant": true |
| 40 | + } |
| 41 | + ] |
| 42 | + }, |
| 43 | + |
| 44 | +## Use-case 2: Make role assignments at lighthouse managed scopes while deploying to the cast instance of that subscription in your tenant. |
| 45 | + |
| 46 | +This feature is primarily meant for MSPs managing customer subscriptions. While the complete implementation is not perfiect, this is due to a deficiency in lighthouse functionality and guidance on the best way to work around that with EPAC is provided. |
| 47 | + |
| 48 | +### Use-case |
| 49 | + |
| 50 | +This feature allows users to assign policies with role assignments to managed subscriptions without direct access to the customer tenant. |
| 51 | + |
| 52 | +### Configurations |
| 53 | + |
| 54 | +1. Lighthouse Setup - Before any of the EPAC functionality can work, you must first provide the service principal executing EPAC (in the managing tenant) the appropriate access in the managed (lighthouse invited) subscriptions. There are two components to this. Because you can configure EPAC to run plans, policy deployments, and role deployments with different service principals or use the same service principal for all of these actions, the guidance here will be written for an implementation using a singular service principal to perform all 3 actions. If you are using a different service principal for each of these stages, adjust the lighthouse template accordingly. |
| 55 | + 1. Determing which roles and permissions are needed for basic EPAC functionality. The combined required roles are Reader, Resource Policy Contributor, and User Access Administrator. |
| 56 | + 1. Determine which roles will be need to be assigned to your policies (DINE/Modify). This is likely a dynamic list and will change over time. Be as proactive and forward thinking as you can in developing this list as any changes to this list will require a re-invite for each lighthouse subscription. |
| 57 | + |
| 58 | +Once These two lists have been developed create your lighthouse invite template. |
| 59 | + |
| 60 | +1. Open Lighthouse in your managing tenant |
| 61 | +1. Click "Manage your Customers" |
| 62 | +1. Click "Create ARM Template" |
| 63 | +1. Give the offer a name and description. |
| 64 | +1. Choose the scopt your will request to manage |
| 65 | +1. Click "+ Add authorization" |
| 66 | + 1. Choose "Principal type" (Service Principal for EPAC) |
| 67 | + 1. Select your principal |
| 68 | + 1. Add Display name |
| 69 | + 1. Select your role (from the list developed in item 1 above e.g. Reader, Resource Policy Contributor, and User Access Administrator) |
| 70 | + 1. Add authorization for all roles that need to be assigned to your principal |
| 71 | + 1. Click "View template" |
| 72 | + 1. Download the template and open it to edit |
| 73 | + 1. In the "authorizations" section, find all instances where you are assigning the User Access Administrator (18d7d88d-d35e-4fb5-a5c3-7773c20a72d9) |
| 74 | + 1. Add the roles determined above in item 2 in a "delegatedRoleDefinitionIds" array, the delegated roles that your User Access Administrator will be able to add and remove. |
| 75 | + |
| 76 | + Example: |
| 77 | + |
| 78 | + "delegatedRoleDefinitionIds": [ |
| 79 | + "b24988ac-6180-42a0-ab88-20f7382dd24c", <----Contributor |
| 80 | + "f353d9bd-d4a6-484e-a77a-8050b599b867", <----Automation Contributor |
| 81 | + "91c1777a-f3dc-4fae-b103-61d183457e46" <----Managed Services Registration assignment Delete Role |
| 82 | + ] |
| 83 | + |
| 84 | + Once this is completed send this file to your customer to be executed in each of their subscriptions where you will need to manage policies. It will take between 30 seconds and 30 minutes for the registration to comnplete (usually closere to 30 seconds). To view your customers go to lighthouse in your tenant and view customers. If you are not seeing all of them you need to change your global filters. |
| 85 | + |
| 86 | + After the Lighthouse portion is complete you will need to set things up in EPAC for each target subscription. Below is an example with explanation of the relevant properties. |
| 87 | + |
| 88 | + { |
| 89 | + "pacSelector": "epac-ManagedCustomerSubscription1", |
| 90 | + "cloud": "AzureCloud", |
| 91 | + "tenantId": "00000000-1111-2222-3333-444444444444", <----My Tenant |
| 92 | + "deploymentRootScope": "/subscriptions/999999-8888-7777-6666-555555555555", <----Customer subscription |
| 93 | + "managedSubscription": true, <----Indicates this is a managed subscription |
| 94 | + "managedIdentityLocation": "eastus2", |
| 95 | + "managedTenant": { |
| 96 | + "managedTenantId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", <----Customer tenant ID |
| 97 | + "managedTenantScopes": [ |
| 98 | + "/subscriptions/999999-8888-7777-6666-555555555555" <----Customer subscription |
| 99 | + ] |
| 100 | + }, |
| 101 | + "desiredState": { |
| 102 | + "strategy": "full", |
| 103 | + "keepDfcSecurityAssignments": false |
| 104 | + }, |
| 105 | + "deployedBy": "My Org Admins" <----Friendly name to indicate who is deploying policy |
| 106 | + }, |
| 107 | + |
| 108 | +NOTE: Because Lighthouse does not allow grouping of "cast" lighthouse subscriptions to be grouped in the managing tenant, and does not allow for management groups to be cast, each unique subscription must be a unique pacEnvironment. The best way to perform "mass" deployments is through custom pipelines that will create multiples plans with unique names and then run multiple deployments. It is recommended to use Self-hosted agents in this scenario as you can create larger SKU agents that will allow for parallelism. |
0 commit comments