Skip to content

Commit 7ccb663

Browse files
msftadammsftadam
authored
Update how-to-create-user-assigned-managed-identity.md
updates for operator
1 parent 6e8dccd commit 7ccb663

File tree

1 file changed

+163
-9
lines changed

1 file changed

+163
-9
lines changed

‎articles/operator-service-manager/how-to-create-user-assigned-managed-identity.md

Lines changed: 163 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
11
---
2-
title: How to create and assign User Assigned Managed Identity in Azure Operator Service Manager
3-
description: Learn how to create and assign a User Assigned Managed Identity in Azure Operator Service Manager.
2+
title: How to create, assign and use a User Assigned Managed Identity in Azure Operator Service Manager
3+
description: Learn how to create, assign and use a User Assigned Managed Identity in Azure Operator Service Manager.
44
author: msftadam
55
ms.author: adamdor
66
ms.date: 6/9/2025
77
ms.topic: how-to
88
ms.service: azure-operator-service-manager
99
---
1010

11-
# Create and assign a User Assigned Managed Identity
11+
# Create, assign and use a User Assigned Managed Identity
1212

13-
In this how-to guide, you learn how to:
14-
- Create a User Assigned Managed Identity (UAMI) for your Site Network Service (SNS).
15-
- Assign that User Assigned Managed Identity permissions for use by Azure Operator Service Manager (AOSM)
13+
In this how-to guide, you learn to:
14+
- Create a User Assigned Managed Identity (UAMI) to use with Azure Operator Service Manager (AOSM)
15+
- Assign a UAMI permissions to access required resources.
16+
- Use a UAMI when executing network function (NF) or site network service (SNS) operations.
1617

1718
> [!WARNING]
1819
> UAMI is required where an expected SNS operation may run for four or more hours. If UAMI isn't used during long running SNS operations, the SNS may report a false failed status before component operations complete.
@@ -25,11 +26,11 @@ In this how-to guide, you learn how to:
2526

2627
- You need either the 'Owner' or 'User Access Administrator' role over the Network Function Definition Version resource from your chosen Publisher. You also must have a Resource Group over which you have the 'Owner' or 'User Access Administrator' role assignment.
2728

28-
## Create a UAMI
29+
## Create a UAMI via portal
2930

3031
First, create a UAMI. Refer to [Create a User Assigned Managed Identity for your SNS](/azure/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp) for details.
3132

32-
## Assign custom role to UAMI
33+
## Assign custom role to UAMI via portal
3334

3435
Next, assign a custom role to your new UAMI. Choose a scope-based approach and then allow the proper permission across that scope.
3536

@@ -109,6 +110,159 @@ Repeat the role assignment process for any remaining resources given the chosen
109110

110111
Completion of all the tasks outlined in this article ensures that the Site Network Service (SNS) has the necessary permissions to function effectively within the specified Azure environment.
111112

112-
## Assign other required permissions to the Managed Identity
113+
### Assign other required permissions to the Managed Identity
113114

114115
Repeat this process to assign any other permissions to the Managed Identity that your Network Service Designer identified.
116+
117+
## Create and assign permissions to a UAMI via bicep
118+
119+
The required operations to create and assign permissions are also supported via bicep scripting. This approach may work better where automation of these operations within a workflow pipeline is neccesary. The following example demonstrates the bicep operations required to establish the UAMI with minimum assigned roles. It will be neccesary to expand role assignment based on scope approach.
120+
121+
```bicep
122+
// ----------- MIO Role Definition -----------
123+
// This role is used to assign the Managed Identity Operator role to the User Assigned Managed Identity (UAMI).
124+
@description('This is the built-in MIO role. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#managed-identity-operator')
125+
resource MIORoleDefinition 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
126+
scope: managedIdentity
127+
name: 'f1a07417-d97a-45cb-824c-7a7467783830'
128+
}
129+
130+
// This role is used to assign the Contributor role to the User Assigned Managed Identity (UAMI) at the resource group level.
131+
resource ContributorRoleDefinition 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
132+
scope: subscription()
133+
name: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
134+
}
135+
136+
// Assign the Managed Identity Operator role to the User Assigned Managed Identity (UAMI) at the scope of the managed identity.
137+
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
138+
name: guid(resourceGroup().id, principalId, MIORoleDefinition.id)
139+
scope: managedIdentity
140+
properties: {
141+
roleDefinitionId: MIORoleDefinition.id
142+
principalId: managedIdentity.properties.principalId
143+
principalType: 'ServicePrincipal'
144+
}
145+
}
146+
// Get reference to the target resource group
147+
resource targetRg 'Microsoft.Resources/resourceGroups@2022-09-01' existing = {
148+
name: 'publisherResourceGroupName' // Replace with the actual resource group name
149+
scope: subscription('subscriptionId')
150+
}
151+
152+
// Assign the Contributor role to the User Assigned Managed Identity (UAMI) at the scope of the publisher resource group.
153+
resource roleAssignmentContributor 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
154+
name: guid(resourceGroup().id, principalId, ContributorRoleDefinition.id)
155+
scope: targetRg
156+
properties: {
157+
roleDefinitionId: ContributorRoleDefinition.id
158+
principalId: managedIdentity.properties.principalId
159+
principalType: 'ServicePrincipal'
160+
}
161+
}
162+
```
163+
164+
## Use a UAMI with NF and SNS operations
165+
166+
### NF template considerations
167+
168+
The NF template must be updated to include the identityObj parameter. The following JSON example demonstrates use of this parameter with a generic NF setup:
169+
170+
```json
171+
{
172+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
173+
"contentVersion": "1.0.0.0",
174+
"parameters": {
175+
"nameValue": {
176+
"type": "string",
177+
"defaultValue": "[concat('anf-', substring(uniqueString(deployment().name), 0, 6))]"
178+
},
179+
"locationValue": {
180+
"type": "string",
181+
"defaultValue": "eastus2euap"
182+
},
183+
"nfviTypeValue": {
184+
"type": "string",
185+
"defaultValue": "AzureArcKubernetes"
186+
},
187+
"nfviIdValue": {
188+
"type": "string"
189+
},
190+
"config": {
191+
"type": "object",
192+
"defaultValue": {}
193+
},
194+
"nfdvId": {
195+
"type": "string"
196+
},
197+
"identityObj": {
198+
"type": "object",
199+
"defaultValue": {
200+
"type": "UserAssigned",
201+
"userAssignedIdentities": {
202+
"/subscriptions/<subscriptionId>/resourceGroups/<rgName>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<uaminame>": {}
203+
}
204+
}
205+
}
206+
},
207+
"variables": {
208+
"deploymentValuesValue": "[string(createObject('role1releasenamespace', parameters('config').role1releasenamespace, 'role1releasename',parameters('config').role1releasename, 'role2releasenamespace', parameters('config').role2releasenamespace, 'role2releasename',parameters('config').role2releasename,'role3releasenamespace', parameters('config').role3releasenamespace, 'role3releasename',parameters('config').role3releasename))]",
209+
"nfName": "[concat(parameters('nameValue'), '-CNF')]"
210+
},
211+
"resources": [
212+
{
213+
"type": "Microsoft.HybridNetwork/networkFunctions",
214+
"apiVersion": "2024-04-15",
215+
"name": "[variables('nfName')]",
216+
"location": "[parameters('locationValue')]",
217+
"identity": "[parameters('identityObj')]",
218+
"properties": {
219+
"networkFunctionDefinitionVersionResourceReference": {
220+
"id": "[parameters('nfdvId')]",
221+
"idType": "Open"
222+
},
223+
"nfviType": "[parameters('nfviTypeValue')]",
224+
"nfviId": "[parameters('nfviIdValue')]",
225+
"allowSoftwareUpdate": true,
226+
"configurationType": "Secret",
227+
"secretDeploymentValues": "[string(variables('deploymentValuesValue'))]"
228+
}
229+
}
230+
]
231+
}
232+
```
233+
### SNS template considerations
234+
235+
The SNS template must be updated to include the identity resource parameter. The following bicep example demonstrates use of this parameter with a generic SNS setup:
236+
237+
```bicep
238+
resource azCoreSnsUAMI 'Microsoft.HybridNetwork/sitenetworkservices@2023-09-01' = {
239+
name: snsNameUAMI
240+
location: location
241+
sku: {
242+
name: 'Standard'
243+
}
244+
identity: {
245+
type: 'UserAssigned'
246+
userAssignedIdentities: {
247+
'${managedIdentity.id}': {}
248+
}
249+
}
250+
properties: {
251+
siteReference: {
252+
id: azCoreSite.id
253+
}
254+
networkServiceDesignVersionResourceReference: {
255+
id: nsdv.id
256+
idType: 'Open'
257+
}
258+
desiredStateConfigurationGroupValueReferences: {
259+
Test_Configuration: {
260+
id: azCoreCgv.id
261+
}
262+
Secret_Configuration:{
263+
id:azCoreCgvSecret.id
264+
}
265+
}
266+
}
267+
}
268+
```

0 commit comments

Comments
 (0)