Skip to content

Commit b3a8326

Browse files
denreadenrea
authored
Merge pull request #301430 from msftadam/patch-81
Update how-to-create-user-assigned-managed-identity.md
2 parents 51a8d4d + e4958a3 commit b3a8326

File tree

1 file changed

+171
-21
lines changed

1 file changed

+171
-21
lines changed

‎articles/operator-service-manager/how-to-create-user-assigned-managed-identity.md

Lines changed: 171 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,19 @@
11
---
2-
title: How to create and assign User Assigned Managed Identity in Azure Operator Service Manager
3-
description: Learn how to create and assign a User Assigned Managed Identity in Azure Operator Service Manager.
2+
title: How to create, assign, and use a User Assigned Managed Identity in Azure Operator Service Manager
3+
description: Learn how to create, assign, and use a User Assigned Managed Identity in Azure Operator Service Manager.
44
author: msftadam
55
ms.author: adamdor
66
ms.date: 6/9/2025
77
ms.topic: how-to
88
ms.service: azure-operator-service-manager
99
---
1010

11-
# Create and assign a User Assigned Managed Identity
11+
# Create, assign, and use a User Assigned Managed Identity
1212

13-
In this how-to guide, you learn how to:
14-
- Create a User Assigned Managed Identity (UAMI) for your Site Network Service (SNS).
15-
- Assign that User Assigned Managed Identity permissions for use by Azure Operator Service Manager (AOSM)
13+
In this how-to guide, you learn to:
14+
- Create a User Assigned Managed Identity (UAMI) to use with Azure Operator Service Manager (AOSM)
15+
- Assign a UAMI permissions to access required resources.
16+
- Use a UAMI when executing network function (NF) or site network service (SNS) operations.
1617

1718
> [!WARNING]
1819
> UAMI is required where an expected SNS operation may run for four or more hours. If UAMI isn't used during long running SNS operations, the SNS may report a false failed status before component operations complete.
@@ -29,13 +30,13 @@ In this how-to guide, you learn how to:
2930

3031
First, create a UAMI. Refer to [Create a User Assigned Managed Identity for your SNS](/azure/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp) for details.
3132

32-
## Assign custom role to UAMI
33+
## Create a custom role and assign to UAMI
3334

34-
Next, assign a custom role to your new UAMI. Choose a scope-based approach and then allow the proper permission across that scope.
35+
Next, create a custom role. Start by considering the best scope-based approach, then create and assign the role to your new UAMI.
3536

36-
### Choose scope for assigning custom role
37+
### Scope considerations for UAMI custom role
3738

38-
Either assign the custom role individually to a child resource, like an NFDV, or to a parent resource, such as the publisher resource group or Network Function Definition Group (NFDG). Assigning the role to a parent resource grants equal access over all child resources. For proper SNS operations, either the parent resource must include all below resources, or the following resources must be assigned the custom role individually:
39+
The custom role must be assigned sufficient permissions to access user resources. The custom role can be scoped to individual child resources, like an NFDV, for the most granular control. Or, the custom role can be scope to a parent resource, such as the publisher resource group, which grants equal access over all child resources. For proper operations, either individually or via parent, all below resources must be assigned to the custom role:
3940

4041
- All the Network Function Definition Groups (NFDG) and versions.
4142
- All the Network Function Definition (NFD) and versions.
@@ -47,26 +48,26 @@ Either assign the custom role individually to a child resource, like an NFDV, or
4748

4849
The UAMI needs the following individual permissions to execute required SNS operations:
4950

50-
- On the NFDV
51+
- On the NFD;
5152
- Microsoft.HybridNetwork/publishers/networkFunctionDefinitionGroups/networkFunctionDefinitionVersions/use/**action**
5253
- Microsoft.HybridNetwork/Publishers/NetworkFunctionDefinitionGroups/NetworkFunctionDefinitionVersions/**read**
53-
- On the NSDV
54+
- On the NSD;
5455
- Microsoft.HybridNetwork/publishers/networkServiceDesignGroups/networkServiceDesignVersions/use/action
5556
- Microsoft.HybridNetwork/publishers/networkServiceDesignGroups/networkServiceDesignVersions/**read**
56-
- On the CGS
57+
- On the CGS;
5758
- Microsoft.HybridNetwork/Publishers/ConfigurationGroupSchemas/**read**
58-
- On the custom location
59+
- On the custom location;
5960
- Microsoft.ExtendedLocation/customLocations/deploy/**action**
6061
- Microsoft.ExtendedLocation/customLocations/**read**
61-
- In addition, the UAMI need access on itself
62+
- In addition, the UAMI need access on itself;
6263
- Microsoft.ManagedIdentity/userAssignedIdentities/assign/**action**
6364

6465
If using a parent resource scope approach, then the required permissions would be applied to the parent resource.
6566

6667
> [!NOTE]
6768
> Don't provide write or delete access to any of these publisher resources.
6869
69-
### Assign custom role
70+
### Assign custom role via portal
7071

7172
1. Access the Azure portal and open your chosen resource scope; for example, Publisher Resource Group or Network Function Definition Version.
7273

@@ -86,11 +87,11 @@ If using a parent resource scope approach, then the required permissions would b
8687

8788
6. Select **Review and assign**.
8889

89-
### Repeat the role assignment
90+
#### Repeat the role assignment
9091

9192
Repeat the role assignment process for any remaining resources given the chosen scope approach.
9293

93-
## Assign Managed Identity Operator role to the Managed Identity itself
94+
### Assign managed identity operator role via portal
9495

9596
1. Go to the Azure portal and search for **Managed Identities**.
9697
2. Select *your-identity* from the list of **Managed Identities**.
@@ -109,6 +110,155 @@ Repeat the role assignment process for any remaining resources given the chosen
109110

110111
Completion of all the tasks outlined in this article ensures that the Site Network Service (SNS) has the necessary permissions to function effectively within the specified Azure environment.
111112

112-
## Assign other required permissions to the Managed Identity
113-
114-
Repeat this process to assign any other permissions to the Managed Identity that your Network Service Designer identified.
113+
## Create and assign permissions to a UAMI via bicep
114+
115+
The required operations to create and assign permissions are also supported via bicep scripting. This approach may work better where automation of these operations within a workflow pipeline is necessary. The following example demonstrates the bicep operations required to establish the UAMI with minimum assigned roles. Expand role assignment, as necessary, based on scope approach.
116+
117+
```bicep
118+
// ----------- MIO Role Definition -----------
119+
// This role is used to assign the Managed Identity Operator role to the User Assigned Managed Identity (UAMI).
120+
@description('This is the built-in MIO role. See https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#managed-identity-operator')
121+
resource MIORoleDefinition 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
122+
scope: managedIdentity
123+
name: 'f1a07417-d97a-45cb-824c-7a7467783830'
124+
}
125+
126+
// This role is used to assign the Contributor role to the User Assigned Managed Identity (UAMI) at the resource group level.
127+
resource ContributorRoleDefinition 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
128+
scope: subscription()
129+
name: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
130+
}
131+
132+
// Assign the Managed Identity Operator role to the User Assigned Managed Identity (UAMI) at the scope of the managed identity.
133+
resource roleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
134+
name: guid(resourceGroup().id, principalId, MIORoleDefinition.id)
135+
scope: managedIdentity
136+
properties: {
137+
roleDefinitionId: MIORoleDefinition.id
138+
principalId: managedIdentity.properties.principalId
139+
principalType: 'ServicePrincipal'
140+
}
141+
}
142+
// Get reference to the target resource group
143+
resource targetRg 'Microsoft.Resources/resourceGroups@2022-09-01' existing = {
144+
name: 'publisherResourceGroupName' // Replace with the actual resource group name
145+
scope: subscription('subscriptionId')
146+
}
147+
148+
// Assign the Contributor role to the User Assigned Managed Identity (UAMI) at the scope of the publisher resource group.
149+
resource roleAssignmentContributor 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
150+
name: guid(resourceGroup().id, principalId, ContributorRoleDefinition.id)
151+
scope: targetRg
152+
properties: {
153+
roleDefinitionId: ContributorRoleDefinition.id
154+
principalId: managedIdentity.properties.principalId
155+
principalType: 'ServicePrincipal'
156+
}
157+
}
158+
```
159+
160+
## Use a UAMI with NF and SNS operations
161+
162+
### NF template considerations
163+
164+
The NF template must be updated to include the identityObj parameter. The following JSON example demonstrates use of this parameter with a generic NF setup:
165+
166+
```json
167+
{
168+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
169+
"contentVersion": "1.0.0.0",
170+
"parameters": {
171+
"nameValue": {
172+
"type": "string",
173+
"defaultValue": "[concat('anf-', substring(uniqueString(deployment().name), 0, 6))]"
174+
},
175+
"locationValue": {
176+
"type": "string",
177+
"defaultValue": "eastus2euap"
178+
},
179+
"nfviTypeValue": {
180+
"type": "string",
181+
"defaultValue": "AzureArcKubernetes"
182+
},
183+
"nfviIdValue": {
184+
"type": "string"
185+
},
186+
"config": {
187+
"type": "object",
188+
"defaultValue": {}
189+
},
190+
"nfdvId": {
191+
"type": "string"
192+
},
193+
"identityObj": {
194+
"type": "object",
195+
"defaultValue": {
196+
"type": "UserAssigned",
197+
"userAssignedIdentities": {
198+
"/subscriptions/<subscriptionId>/resourceGroups/<rgName>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<uaminame>": {}
199+
}
200+
}
201+
}
202+
},
203+
"variables": {
204+
"deploymentValuesValue": "[string(createObject('role1releasenamespace', parameters('config').role1releasenamespace, 'role1releasename',parameters('config').role1releasename, 'role2releasenamespace', parameters('config').role2releasenamespace, 'role2releasename',parameters('config').role2releasename,'role3releasenamespace', parameters('config').role3releasenamespace, 'role3releasename',parameters('config').role3releasename))]",
205+
"nfName": "[concat(parameters('nameValue'), '-CNF')]"
206+
},
207+
"resources": [
208+
{
209+
"type": "Microsoft.HybridNetwork/networkFunctions",
210+
"apiVersion": "2024-04-15",
211+
"name": "[variables('nfName')]",
212+
"location": "[parameters('locationValue')]",
213+
"identity": "[parameters('identityObj')]",
214+
"properties": {
215+
"networkFunctionDefinitionVersionResourceReference": {
216+
"id": "[parameters('nfdvId')]",
217+
"idType": "Open"
218+
},
219+
"nfviType": "[parameters('nfviTypeValue')]",
220+
"nfviId": "[parameters('nfviIdValue')]",
221+
"allowSoftwareUpdate": true,
222+
"configurationType": "Secret",
223+
"secretDeploymentValues": "[string(variables('deploymentValuesValue'))]"
224+
}
225+
}
226+
]
227+
}
228+
```
229+
### SNS template considerations
230+
231+
The SNS template must be updated to include the identity resource parameter. The following bicep example demonstrates use of this parameter with a generic SNS setup:
232+
233+
```bicep
234+
resource azCoreSnsUAMI 'Microsoft.HybridNetwork/sitenetworkservices@2023-09-01' = {
235+
name: snsNameUAMI
236+
location: location
237+
sku: {
238+
name: 'Standard'
239+
}
240+
identity: {
241+
type: 'UserAssigned'
242+
userAssignedIdentities: {
243+
'${managedIdentity.id}': {}
244+
}
245+
}
246+
properties: {
247+
siteReference: {
248+
id: azCoreSite.id
249+
}
250+
networkServiceDesignVersionResourceReference: {
251+
id: nsdv.id
252+
idType: 'Open'
253+
}
254+
desiredStateConfigurationGroupValueReferences: {
255+
Test_Configuration: {
256+
id: azCoreCgv.id
257+
}
258+
Secret_Configuration:{
259+
id:azCoreCgvSecret.id
260+
}
261+
}
262+
}
263+
}
264+
```

0 commit comments

Comments
 (0)