You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
While EPAC is not currently able to handle all use cases for lighthouse integration, there are twe specific use cases requested through GH issues that have been accounted for. The following is offered as guidance around those use cases. It is possible that the work done to account for these use cases does allow for other, untested, functionality; so trying different permutations of below mentioned pacEnv settings may result in additional, undocumented functionality.
5
+
While EPAC is not currently able to handle all use cases for Lighthouse integration, there are two specific use cases requested through GitHub issues that have been accounted for. The following is offered as guidance around those use cases. It is possible that the work done to account for these use cases may allow for other, untested functionality; so trying different permutations of the below-mentioned pacSelector settings may result in additional, undocumented functionality.
6
6
7
7
## Use-case 1: Additional role assignment from managing tenant to managed subscriptions
8
8
9
-
There are some instances where you may need to make additional role assignments to managed subscriptions while assigning policy at your managing tenant. The guidance below will cover a specific use case and all EPAC configurations necessary to achieve this use case.
9
+
There are instances where you may need to make additional role assignments to managed subscriptions while assigning policy at your managing tenant. The guidance below covers a specific use case and all EPAC configurations necessary to achieve it.
10
10
11
11
### Use-case
12
12
13
-
When assigning Deploy Diagnostics Settings type policies at a scope in your managing tenant, you want to write the diagnostics data to a managed (lighhouse joined) subscription.
13
+
When assigning Deploy Diagnostic Settings type policies at a scope in your managing tenant, you want to write the diagnostics data to a managed (Lighthouse-joined) subscription.
14
14
15
15
### Configurations
16
16
17
17
1. pacSelector Configuration.
18
18
19
-
In your global settings file find the specific pagEnvironments that will have diagnostic settings policy deployed to them where the diagnostics data needs to be written to lighthouse managed subscription. Add the following to that pacSelector in the global settings file:
19
+
In your global settings file, find the specific pacEnvironments that will have diagnostic settings policy deployed to them, where the diagnostics data needs to be written to a Lighthouse-managed subscription. Add the following to that pacSelector in the global settings file:
@@ -26,10 +26,10 @@ In your global settings file find the specific pagEnvironments that will have di
26
26
]
27
27
},
28
28
29
-
managedTenantId - The tenant containing the lighthouse managed (joined) subsciptions.
30
-
managedTenantScopes - A list of all subscriptions that may need "remote" role assignments made to them. These would be the subscriptions that contain, for example, the Log Analytics Workspace or Storage Account that your are writing diagnostics data to across tenants. Every subscription where this pacEnvironment may need to make a role assignment to must be listed.
29
+
-**managedTenantId** - The tenant containing the lighthouse managed (joined) subsciptions.
30
+
-**managedTenantScopes** - A list of all subscriptions that may need "remote" role assignments made to them. These would be the subscriptions that contain, for example, the Log Analytics Workspace or Storage Account that your are writing diagnostics data to across tenants. Every subscription where this pacEnvironment may need to make a role assignment to must be listed.
31
31
32
-
1. In the assignment file add an additionalRoleAssignments section for the file or node so that the assignment knows that for assigning this policy, at this (managing) pacEnvironment, it needs to perform and additional role assignment at the remote (managed) scope. The scope of the assignment must be included in the managedTenantScopes for the pacEnvironment in the globalSettings file.
32
+
1. In the assignment file, add an additionalRoleAssignments section for the file or node so that the assignment knows that for assigning this policy, at this (managing) pacEnvironment, it needs to perform an additional role assignment at the remote (managed) scope. The scope of the assignment must be included in the managedTenantScopes for the pacEnvironment in the globalSettings file.
33
33
34
34
"additionalRoleAssignments": {
35
35
"managingTenantScopeEnv": [
@@ -41,68 +41,84 @@ managedTenantScopes - A list of all subscriptions that may need "remote" role as
41
41
]
42
42
},
43
43
44
-
## Use-case 2: Make role assignments at lighthouse managed scopes while deploying to the cast instance of that subscription in your tenant.
44
+
## Use-case 2: Make Role Assignments at Lighthouse-Managed Scopes While Deploying to the Cast Instance of That Subscription in Your Tenant
45
45
46
-
This feature is primarily meant for MSPs managing customer subscriptions. While the complete implementation is not perfiect, this is due to a deficiency in lighthouse functionality and guidance on the best way to work around that with EPAC is provided.
46
+
This feature is primarily meant for MSPs managing customer subscriptions. While the complete implementation is not perfect, this is due to a deficiency in Lighthouse functionality. Guidance on the best way to work around that with EPAC is provided.
47
47
48
48
### Use-case
49
49
50
50
This feature allows users to assign policies with role assignments to managed subscriptions without direct access to the customer tenant.
51
51
52
52
### Configurations
53
53
54
-
1. Lighthouse Setup - Before any of the EPAC functionality can work, you must first provide the service principal executing EPAC (in the managing tenant) the appropriate access in the managed (lighthouse invited) subscriptions. There are two components to this. Because you can configure EPAC to run plans, policy deployments, and role deployments with different service principals or use the same service principal for all of these actions, the guidance here will be written for an implementation using a singular service principal to perform all 3 actions. If you are using a different service principal for each of these stages, adjust the lighthouse template accordingly.
55
-
1. Determing which roles and permissions are needed for basic EPAC functionality. The combined required roles are Reader, Resource Policy Contributor, and User Access Administrator.
56
-
1. Determine which roles will be need to be assigned to your policies (DINE/Modify). This is likely a dynamic list and will change over time. Be as proactive and forward thinking as you can in developing this list as any changes to this list will require a re-invite for each lighthouse subscription.
57
-
58
-
Once These two lists have been developed create your lighthouse invite template.
59
-
60
-
1. Open Lighthouse in your managing tenant
61
-
1. Click "Manage your Customers"
62
-
1. Click "Create ARM Template"
63
-
1. Give the offer a name and description.
64
-
1. Choose the scopt your will request to manage
65
-
1. Click "+ Add authorization"
66
-
1. Choose "Principal type" (Service Principal for EPAC)
67
-
1. Select your principal
68
-
1. Add Display name
69
-
1. Select your role (from the list developed in item 1 above e.g. Reader, Resource Policy Contributor, and User Access Administrator)
70
-
1. Add authorization for all roles that need to be assigned to your principal
71
-
1. Click "View template"
72
-
1. Download the template and open it to edit
73
-
1. In the "authorizations" section, find all instances where you are assigning the User Access Administrator (18d7d88d-d35e-4fb5-a5c3-7773c20a72d9)
74
-
1. Add the roles determined above in item 2 in a "delegatedRoleDefinitionIds" array, the delegated roles that your User Access Administrator will be able to add and remove.
54
+
**Lighthouse Setup**
55
+
56
+
Before any EPAC functionality can work, you must first provide the service principal executing EPAC (in the managing tenant) the appropriate access in the managed (Lighthouse-invited) subscriptions. There are two components to this. Because you can configure EPAC to run plans, policy deployments, and role deployments with different service principals—or use the same service principal for all three actions—the guidance here assumes a singular service principal. If you are using a different service principal for each stage, adjust the Lighthouse template accordingly.
57
+
58
+
1.**Determine Required Roles for Basic EPAC Functionality**
59
+
- The combined required roles are:
60
+
- Reader
61
+
- Resource Policy Contributor
62
+
- User Access Administrator.
63
+
64
+
1.**Determine Roles Needed for Policy Assignments (DINE/Modify)**
65
+
- This is likely a dynamic list and will change over time. Be as proactive and forward thinking as you can in developing this list as any changes to this list will require a re-invite for each lighthouse subscription.
66
+
67
+
1.**Create Your Lighthouse Invite Template**
68
+
69
+
1. Open Lighthouse in your managing tenant
70
+
1. Click "Manage your Customers"
71
+
1. Click "Create ARM Template"
72
+
1. Give the offer a name and description.
73
+
1. Choose the scopt your will request to manage
74
+
1. Click "+ Add authorization"
75
+
1. Choose "Principal type" (Service Principal for EPAC)
76
+
1. Select your principal
77
+
1. Add Display name
78
+
1. Select your role (from the list developed in item 1 above e.g. Reader, Resource Policy Contributor, and User Access Administrator)
79
+
1. Add authorization for all roles that need to be assigned to your principal
80
+
1. Click "View template"
81
+
1. Download the template and open it to edit
82
+
1. In the "authorizations" section, find all instances where you are assigning the User Access Administrator (18d7d88d-d35e-4fb5-a5c3-7773c20a72d9)
83
+
1. Add the roles determined above in item 2 in a "delegatedRoleDefinitionIds" array, the delegated roles that your User Access Administrator will be able to add and remove.
"91c1777a-f3dc-4fae-b103-61d183457e46"<----Managed Services Registration assignment Delete Role
82
92
]
83
-
84
-
Once this is completed send this file to your customer to be executed in each of their subscriptions where you will need to manage policies. It will take between 30 seconds and 30 minutes for the registration to comnplete (usually closere to 30 seconds). To view your customers go to lighthouse in your tenant and view customers. If you are not seeing all of them you need to change your global filters.
85
-
86
-
After the Lighthouse portion is complete you will need to set things up in EPAC for each target subscription. Below is an example with explanation of the relevant properties.
"deployedBy": "My Org Admins" <----Friendly name to indicate who is deploying policy
93
+
```
94
+
95
+
Once completed, send this file to your customer to be executed in each of their subscriptions where you will need to manage policies. It will take between 30 seconds and 30 minutes for the registration to complete (usually closer to 30 seconds). To view your customers, go to Lighthouse in your tenant and view customers. If you are not seeing all of them, you may need to change your global filters.
96
+
97
+
**EPAC Setup for Each Target Subscription**
98
+
99
+
After the Lighthouse portion is complete you will need to set things up in EPAC for each target subscription. Below is an example with explanation of the relevant properties.
"deployedBy": "My Org Admins"<----Friendly name to indicate who is deploying policy
120
+
},
121
+
```
107
122
108
-
NOTE: Because Lighthouse does not allow grouping of "cast" lighthouse subscriptions to be grouped in the managing tenant, and does not allow for management groups to be cast, each unique subscription must be a unique pacEnvironment. The best way to perform "mass" deployments is through custom pipelines that will create multiples plans with unique names and then run multiple deployments. It is recommended to use Self-hosted agents in this scenario as you can create larger SKU agents that will allow for parallelism.
123
+
> [!NOTE]
124
+
> Because Lighthouse does not allow grouping of "cast" Lighthouse subscriptions in the managing tenant, and does not allow for management groups to be cast, each unique subscription must be a unique pacEnvironment. The best way to perform mass deployments is through custom pipelines that create multiple plans with unique names and then run multiple deployments. It is recommended to use self-hosted agents in this scenario, as you can create larger SKU agents that allow for parallelism.
Copy file name to clipboardExpand all lines: Docs/start-changes.md
+6-4Lines changed: 6 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,15 +7,17 @@
7
7
8
8
### Changes in Lighthouse Deployments
9
9
10
-
EPAC is introducing updates that affect how role assignments are handled across managing and managed Lighthouse tenants. While EPAC does not yet support all Lighthouse scenarios, two specific use cases have been implemented based on GitHub issue feedback. These changes will break existing configurations that do not follow the new guidance detailed in [Lighhouse Subscription Management with EPAC](guidance-lighthouse.md)
10
+
EPAC is introducing updates that affect how role assignments are handled across managing and managed Lighthouse tenants. While EPAC does not yet support all Lighthouse scenarios, two specific use cases have been implemented based on GitHub issue feedback. These changes will break existing configurations that do not follow the new guidance detailed in [Lighthouse Subscription Management with EPAC](guidance-lighthouse.md).
11
11
12
-
For users currently leveraging EPAC for Lighthouse deployments, an immediate update to the global-settings.jsonc file is required. The existing properties will become outdated and will cause pipeline failures if not corrected. To ensure successful deployments, please update the global settings configuration without delay.
12
+
For users currently leveraging EPAC for Lighthouse deployments, once v11.0.0 is released an immediate update to the global-settings.jsonc file is required. The existing properties will become outdated and will cause pipeline failures if not corrected. To ensure successful deployments, please update the global settings configuration without delay.
13
+
14
+
**Use Case 1**
13
15
14
-
Use Case 1:
15
16
- Role Assignments from Managing Tenant to Managed Subscriptions
16
17
Scenario: Deploying diagnostics policies in the managing tenant that write data to resources in Lighthouse-managed subscriptions.
17
18
18
-
Use Case 2
19
+
**Use Case 2**
20
+
19
21
- Role Assignments Within Managed Subscriptions (Cast Instances)
20
22
Scenario: MSPs deploying policies with role assignments to customer subscriptions without direct access to their tenant.
0 commit comments