Skip to content

Commit 01dcb41

Browse files
davidsmatlakdavidsmatlak
committed
adds delegated managed identity resource id
1 parent 964aaeb commit 01dcb41

File tree

3 files changed

+130
-32
lines changed

3 files changed

+130
-32
lines changed

‎articles/azure-resource-manager/managed-applications/concepts-delegated-managed-identity-resource-id.md

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
---
2+
title: Overview of the delegatedManagedIdentityResourceId property
3+
description: Describes the concept of the delegatedManagedIdentityResourceId property for Azure Managed Applications.
4+
ms.topic: overview
5+
ms.date: 02/10/2025
6+
---
7+
8+
# What is the delegatedManagedIdentityResourceId property?
9+
10+
In Azure, the `delegatedManagedIdentityResourceId` property is used to properly assign roles to managed identities across different tenants. This assignment is useful when dealing with managed applications published in Azure Marketplace where the publisher and the customer exist in separate tenants.
11+
12+
## Why do we need it?
13+
14+
When a customer deploys a managed application from the marketplace, the publisher is responsible for managing resources within the managed resource group (MRG). However, any role assignments performed as part of the deployment template occur in the publisher's tenant. These assignments create a challenge when the managed identity is created in the customer's tenant, because role assignment fails if it tries to locate the identity in the wrong tenant.
15+
16+
The `delegatedManagedIdentityResourceId` property resolves this issue by explicitly specifying where the managed identity exists, ensuring that the role assignment process can correctly locate and assign permissions.
17+
18+
## How it works
19+
20+
### Managed identity creation
21+
22+
When you deploy a managed application, the managed identity is created in the customer's tenant.
23+
24+
### Role assignment
25+
26+
Role assignment deployment occurs under the publisher's tenant, role assignments naturally look for identities within that tenant.
27+
28+
### Using delegatedManagedIdentityResourceId
29+
30+
By specifying the correct resource ID:
31+
32+
- **For System Assigned Identities**: Use the resource ID of the resource that holds the identity. For example, a Function App or Logic App.
33+
- **For User Assigned Identities**: Use the resource ID of the identity itself.
34+
35+
## How to apply delegatedManagedIdentityResourceId
36+
37+
To set up role assignment correctly, add the `delegatedManagedIdentityResourceId` property in the role assignment section of your Azure Resource Manager template (ARM template). Example:
38+
39+
```json
40+
{
41+
"type": "Microsoft.Authorization/roleAssignments",
42+
"apiVersion": "2022-04-01",
43+
"properties": {
44+
"roleDefinitionId": "<role-definition-id>",
45+
"principalId": "<principal-id>",
46+
"delegatedManagedIdentityResourceId": "<resource-id-of-identity>"
47+
}
48+
}
49+
```
50+
51+
## Common errors and troubleshooting
52+
53+
### Role assignment failure due to missing identity
54+
55+
- Ensure that the correct resource ID is provided in `delegatedManagedIdentityResourceId`.
56+
- Verify that the managed identity exists in the customer's tenant.
57+
58+
### Deny assignment prevents access
59+
60+
- The deny assignment prevents customers access to the MRG.
61+
- Ensure the publisher's identity managing the MRG is correctly referenced in the customer's tenant.
62+
63+
### Misconfigured deployment context
64+
65+
- AMA deployments with published managed apps and publisher access enabled occur in the publisher's tenant.
66+
- Ensure `delegatedManagedIdentityResourceId` is properly set to reference the customer's tenant identity.
67+
68+
### Role assignment PUT request only supported in a cross tenant
69+
70+
A role assignment PUT request with the `delegatedManagedIdentityResourceId` is only supported in cross-tenant scenarios and doesn't support deployments within the same tenant. To use it within the same tenant during testing, add a parameter to include the property as follows:
71+
72+
```json
73+
{
74+
"comments": "Using cross-tenant delegatedManagedIdentityResourceId property",
75+
"type": "Microsoft.Authorization/roleAssignments",
76+
"apiVersion": "2021-04-01-preview",
77+
"name": "[guid(resourceGroup().id, variables('<identityName>'), variables('<roleDefinitionId>'))]",
78+
"dependsOn": [
79+
"[variables('<identityName>')]"
80+
],
81+
"properties": {
82+
"roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions',variables('<roleDefinitionId>'))]",
83+
"principalId": "[reference(variables('<identityName>')).principalId]",
84+
"principalType": "<PrincipalType>",
85+
"scope": "[resourceGroup().id]",
86+
"delegatedManagedIdentityResourceId": "[if(parameters('crossTenant'), resourceId('Microsoft.ManagedIdentity/userAssignedIdentities',variables('<identityName>')), json('null'))]"
87+
}
88+
}
89+
```
90+
91+
### Next steps
92+
93+
> [!div class="nextstepaction"]
94+
> [Azure Managed Application with managed identity](publish-managed-identity.md)

‎articles/azure-resource-manager/managed-applications/publish-managed-identity.md

Lines changed: 34 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Managed app with managed identity
33
description: Configure an Azure Managed Application with managed identity for linking to existing resources, managing Azure resources, and providing operational identity for Activity Log.
44
ms.topic: conceptual
5-
ms.date: 06/24/2024
5+
ms.date: 02/10/2025
66
ms.custom: subject-rbac-steps
77
---
88

@@ -361,7 +361,7 @@ The response contains an array of tokens under the `value` property:
361361

362362
## Create a managed identity and role assignment for managed applications
363363

364-
This section describes how to create a managed identity and assign a role as part of a managed application using publisher access mode.
364+
This section describes how to create a managed identity and assign a role as part of a managed application using publisher access mode.
365365

366366
1. Create a managed identity using an Azure Resource Manager template.
367367

@@ -385,44 +385,46 @@ This section describes how to create a managed identity and assign a role as par
385385
Since the managed identity is not in the home tenant of the target scope, you must apply a delay between creating the managed identity and assigning the role to allow the managed identity to propagate between tenants. Without this delay, Azure Resource Manager might not recognize this identity when used in the template and fail within a future deployment script.
386386

387387
```json
388-
{
389-
"type": "Microsoft.Resources/deploymentScripts",
390-
"apiVersion": "2020-10-01",
391-
"name": "sleepScript",
392-
"location": "[resourceGroup().location]",
393-
"properties": {
394-
"azPowerShellVersion": "2.0",
395-
"scriptContent": "Start-Sleep -Seconds 30",
396-
"timeout": "PT1H",
397-
"cleanupPreference": "OnSuccess",
398-
"retentionInterval": "P1D"
399-
},
400-
"dependsOn": [
401-
"myManagedIdentity"
402-
]
388+
{
389+
"type": "Microsoft.Resources/deploymentScripts",
390+
"apiVersion": "2020-10-01",
391+
"name": "sleepScript",
392+
"location": "[resourceGroup().location]",
393+
"properties": {
394+
"azPowerShellVersion": "2.0",
395+
"scriptContent": "Start-Sleep -Seconds 30",
396+
"timeout": "PT1H",
397+
"cleanupPreference": "OnSuccess",
398+
"retentionInterval": "P1D"
399+
},
400+
"dependsOn": [
401+
"myManagedIdentity"
402+
]
403403
}
404404
```
405405

406406
1. Assign the Contributor role to the managed identity at the scope of the managed resource group.
407407

408408
```json
409-
{
410-
"type": "Microsoft.Authorization/roleAssignments",
411-
"apiVersion": "2020-04-01-preview",
412-
"name": "[guid(resourceGroup().id, 'Contributor')]",
413-
"properties": {
414-
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
415-
"principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'myManagedIdentity'), '2018-11-30').principalId]",
416-
"scope": "[resourceGroup().id]",
417-
"delegatedManagedIdentityResourceId": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities','myManagedIdentity')]"
418-
},
419-
"dependsOn": [
420-
"myManagedIdentity",
421-
"sleepScript"
422-
]
423-
}
409+
{
410+
"type": "Microsoft.Authorization/roleAssignments",
411+
"apiVersion": "2020-04-01-preview",
412+
"name": "[guid(resourceGroup().id, 'Contributor')]",
413+
"properties": {
414+
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
415+
"principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'myManagedIdentity'), '2018-11-30').principalId]",
416+
"scope": "[resourceGroup().id]",
417+
"delegatedManagedIdentityResourceId": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities','myManagedIdentity')]"
418+
},
419+
"dependsOn": [
420+
"myManagedIdentity",
421+
"sleepScript"
422+
]
423+
}
424424
```
425425

426+
The `delegatedManagedIdentityResourceId` property is used to properly assign roles to managed identities across different tenants. This is particularly useful when dealing with managed applications published in the Azure Marketplace, where the publisher and the customer exist in separate tenants. Learn more about [delegatedManagedIdentityResourceId](concepts-delegated-managed-identity-resource-id.md).
427+
426428
## Next steps
427429

428430
> [!div class="nextstepaction"]

‎articles/azure-resource-manager/managed-applications/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@
3939
href: concepts-view-definition.md
4040
- name: Azure Policy for associations
4141
href: concepts-built-in-policy.md
42+
- name: Delegated managed identity resource ID
43+
href: concepts-delegated-managed-identity-resource-id.md
4244
- name: Security
4345
items:
4446
- name: Security baseline

0 commit comments

Comments
 (0)