azure / azure-blueprints Goto Github PK

Current example uses system-assigned managed identity. We need another example using user-assigned.

Also should update the system-assigned example with the added roleAssignment resource to grant blueprint app owner rights.

I have a blueprint file that takes in custom parameters as usual. Now I want to have the ability to make blueprint level variables so that i can do string manipulation (to create names of resources eg) so that I can pass these down to arm templates for example. Is there no way to do this? I would prefer if the blueprint held this logic. The resources that eventually get deployed via this blueprint assignment are named by convention according to the blueprint level parameters, ie the resources are name based on the parameter values, it would be nice to define these all in one place rather than duplicating the logic of how resources are named within the artifact templates that live in the blueprint.

Also I have a secondary question. Where can I find the json schema for blueprint.json files?

I want to pass values between artifacts.
Following the https://github.com/Azure/azure-blueprints/blob/master/README.md#passing-values-between-artifacts and https://docs.microsoft.com/en-us/azure/governance/blueprints/reference/blueprint-functions#artifacts documentation I built a sample Blueprint, where the contents of artifacts are as follows:
templateA.json

{
    "kind": "template",
    "properties": {
      "dependsOn": ["policyAssignment"],
      "template": {
          "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {},
          "variables": {},
          "resources": [],
          "outputs": {
            "myString": {
              "type": "string",
              "value": "Aaa Bbb Ccc"
            }
          }
      },
      "resourceGroup": "SingleRG",
      "displayName": "My ARM TemplateA",
      "parameters": {}
    },
    "type": "Microsoft.Blueprint/blueprints/artifacts",
    "name": "templateA"
}

template B.json

{
    "kind": "template",
    "properties": {
      "dependsOn": ["templateA"],
      "template": {
          "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {},
          "variables": {},
          "resources": []
          
      },
      "resourceGroup": "SingleRG",
      "displayName": "My ARM TemplateB",
      "parameters": {
        "blueprintMyString": {
          "value": "[artifacts('templateA').outputs.myString]"
        }
      }
    },
    "type": "Microsoft.Blueprint/blueprints/artifacts",
    "name": "templateB"
}

Unfortunatelly, Import-AzBlueprintWithArtifact returns
Import-AzBlueprintWithArtifact : This artifact is invalid. Error: 'Parameter 'blueprintMyString' does not exist in the template specified by the blueprint artifact 'templateB'.'

Any idea on what the problem might be? Did I misunderstood the documentation?

Given the fact that a large blueprint requires a very long list of parameters in blueprint.json. Would it be ideal to have each artifact a blueprint file so we could manage easier? I think that could be technically done by refactoring/extending the current Az.Blueprint module?

For example I have roughly 20 function apps that get deployed into individual resource groups in addition to many other resources for an enterprise solution. Can the resource group artifacts be group like artifacts/functions/... my artifacts?

Currently one have to use JSON instead of ARM template (despite the fact that actual contents of template contains valid ARM template). Need better tooling support for authoring blueprints artifacts.

I am having issue with assigning blueprint to subscription thru bicep. Following is the bicep I'm using. I'm using system assigned identity, we don't want to not use user managed identity

resource assignment 'Microsoft.Blueprint/blueprintAssignments@2018-11-01-preview' = {
  name: name
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    displayName: displayName
    blueprintId: blueprintVersionId
    scope: scope
    resourceGroups: {}
    parameters: {
      resourceLocation : {
        value: location
      }     
    }
    locks: {
      mode: 'None'
    }
  }
}

Following is the error I receive:

Exceeded maximum wait time of '00:05:00'. Message: 'Either the Azure Blueprints service principal does not have owner permissions on the target subscription, or the system-assigned managed identity has not yet finished replicating.'.

Blueprint assignment using system assigned works with no problem from the portal. But, I need to this to work from code.

The error says identity may not be finished replicating. How do I implement wait time for it?

Can you please provide a similar guide but using the Azure CLI? Thanks.

I attempt to publish blueprint based on CAF Foundation.

I've defined all the parameters before publishing, but need guidance on the proper format for KV-AccessPolicy, perhap some examples.

My Error:
Publishing blueprint definition 'CAF-Foundation-Blueprint-01' failed.
This artifact is invalid. Error: 'The language expression '"list"' is not valid: the string character '"' at position '0' is not expected.'

screenshot

Hi,

I'm currently building some samples for a customer to deploy partial environments building one on another. The issue I see or probably don't understand is using KeyVault Secrets of existing keys as input to blueprint artifacts. In my case I've an existing keyvault based on a blueprint created which is working fine. The next blueprint will create a single VM referencing the admin password of the already existing keyvault but the keyvault id for the secret is built with the resourceid function and i can't get it to work. Example:

Blueprint artifact of the Virtual machine / parameters section:

"AdminPassword": {
    "reference": {
        "keyVault": {
            "id": "[resourceId(parameters('bpKeyVaultRG'), 'Microsoft.KeyVault/vaults', parameters('bpKeyVaultName'))]"
        },
        "secretName": "[parameters('bpVMAdmin')]"
    }
},

this way i get an error opening the blueprint blade in the portal:

Even if I hardcode the values of id / secretname - the error stays.

The idea is to have the path to the keyvault built based on some of the parameters built and reference the secret without knowing / hardcoding the keyvault ID / path.
My understanding was, the parameters section of the artifact file replaces the parameters file of a arm template and therefore should work with using reference int he parameters section.

Using CI/CD, how can I add change notes to blueprint updates (newly published versions) via REST API or Powershell?

I've been unsuccessful thus far...
https://docs.microsoft.com/en-us/rest/api/blueprints/publishedblueprints/create

Hello, would it be possible to add the functionality to output variables etc like you can from arm templates but as part of an assignation instead?

Hello,

Is there a powershell command which will allow access to individual resources deployed via blueprint (same sort of information available in portal UI on Blueprint assignment page)?
Resources which are being deployed are using random names based off SubscriptionID,ResourceGroup as part of ARM template deployment so I need to be able to retrieve resulting name of resource which was deployed into subscription. I can not figure out how to do that.
Example I deploy SQL and name is coded as
"sqlServerName": "[tolower(concat(parameters('Organization_Name') , uniqueString(subscription().id, resourceGroup().id), '-sqlserver'))]",
How do I find out what was the name of sqlServerName from powershell once Blueprint finished assignment?

Docs that should contain possible strongType values:

https://docs.microsoft.com/en-us/dotnet/api/microsoft.azure.management.blueprint.models.parameterdefinition.strongtype?view=azure-dotnet

https://docs.microsoft.com/en-us/rest/api/blueprints/blueprints/createorupdate#parameterdefinitioncollection

When assigning policy initiatives containing policies with DeployIfNotExists actions through blueprints, role assignments are not included.

This works fine when assigning individual policies.

The policy documentation states that using command-line approaches to assigning policies, the role assignments must be assigned as a post policy assignment task.
https://docs.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources

This is something that is already handled in blueprints for individual policies, but it seems not so for initiatives.

Is this a bug, missing feature, or expected behavior?

I have an issue to assign an earlier published version of a Blueprint, even though the version number is specified it still goes for the latest published version during assignment. The Blueprint has several published version of which version 48f0df98 in the example below is not the latest version

$bp = Get-AzBlueprint -subscriptionId $sub -name $bpname -version 48f0df98
Set-AzBlueprintAssignment -Blueprint $bp -Name $bpname -SubscriptionId $sub -AssignmentFile $assignmentfile

Despite specifying version for $bp the latest version is always used, assigning this version via the portal works without issues.

This article says that the roleDefinitionId on an artifact of kind roleAssignment cannot be parameterized.

As far as I can see, this means that something like the following will not work:

{
    "kind": "roleAssignment",
    "properties": {
        "description": "Assigns a custom role to a principal",
        "displayName": "Custom Role Assignment",
        "principalIds": [
            "[parameters('principal')]"
        ],
        "roleDefinitionId": "[artifacts('customRole').outputs.resourceId]"
    }
}

where the customRole artifact is of kind template and outputs a resourceId which is the resource ID of a custom role that it creates on the subscription.

As noted, I'm aware that this is not supported, however, I would like to hear the reason why, as I'm trying to create a blueprint that both created a custom role definition and assigns it at the same time.

It is probably be possible to do the assignment using ARM templating, however, I would like to avoid it, since doing role assignments in ARM is messy process that does not spark joy (see this issue).

Trying to assign a blueprint to a management group and it errors out. Also, I cannot choose a managementgroup for assignment from portal. However, based on schema documentation, managementGroup is a valid targetScope.

Schema I reviewed:

https://github.com/Azure/azure-rest-api-specs/blob/2682c91af09e45f34b09d68aeaf6f03292d509a6/specification/blueprint/resource-manager/Microsoft.Blueprint/preview/2018-11-01-preview/blueprintDefinition.json

Bicep fragment I'm using:

resource blueprint 'Microsoft.Blueprint/blueprints@2018-11-01-preview' = {
name : blueprintName
properties : {
targetScope :'managementGroup'
...

Error I'm getting if I use targetScope :'managementGroup' instead of targetScope :'subscription':

Deployment failed. Correlation ID: aef16601-80d1-4667-b96a-c9840b1f0d79. {
"status": "Failed",
"error": {
"code": "ResourceDeploymentFailure",
"message": "The resource operation completed with terminal provisioning state 'Failed'.",
"details": [
{
"code": "DeploymentFailed",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
"details": [
{
"code": "BadRequest",
"message": "{\r\n "error": {\r\n "code": "InvalidSchema",\r\n "message": "Path:properties.targetScope, Schema:#/definitions/SharedBlueprintProperties/properties/targetScope, Error: Value \"managementGroup\" is not defined in enum."\r\n }\r\n}"
}
]
}
]
}
}

Not sure if this should be an empty file or not

Hello,

Is there a powershell command which will allow access to individual resources deployed via blueprint (same sort of information available in portal UI on Blueprint assignment page)?
Resources which are being deployed are using random names based off SubscriptionID,ResourceGroup as part of ARM template deployment so I need to be able to retrieve resulting name of resource which was deployed into subscription. I can not figure out how to do that.
Example I deploy SQL and name is coded as
"sqlServerName": "[tolower(concat(parameters('Organization_Name') , uniqueString(subscription().id, resourceGroup().id), '-sqlserver'))]",
How do I find out what was the name of sqlServerName from powershell once Blueprint finished assignment?

I'm working on Automation of blueprints and as part of that I would like to create the artifacts using the json files as shown in https://github.com/Azure/azure-blueprints. I was able to create a policy and add it to the blueprint but I'm unable to add an initiative with parameters?

{
    "kind": "policyAssignment",
    "properties": {
        "displayName": "nist-blueprint-template-bp-Audit NIST SP 800-53 R4 controls",
        "description": "This initiative includes audit and VM Extension deployment policies that address a subset of NIST SP 800-53 R4 controls.",
        "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/cf25b9c1-bd23-4eb6-bd2c-f4f3ac644a5f",
        "parameters": {
            "logAnalyticsWorkspaceId": {
                "value": "[parameters('logAnalyticsWorkspaceId')]"
            },
            "listOfResourceTypes": {
                "metadata": {
                    "displayName": "Resource Types",
                    "strongType": "resourceTypes"
                  },
                "value": "[parameters('listOfResourceTypes')]"
            },
            "MembersToExclude": {
                "value": "[parameters('MembersToExclude')]"
            },
            "MembersToInclude": {
                "value": "[parameters('MembersToInclude')]"
            }
        }
    }
}

Is this a proper way to create initiative as an artifact?

And I get the below error when trying to create the blueprint using the REST API:
{'error': {'code': 'InvalidArtifact', 'message': "This artifact is invalid. Error: 'Parameter 'logAnalyticsWorkspaceId' does not exist in the policy definition specified by blueprint artifact '_Audit-NIST-SP-800-53-R4-controls'.'"}}

I think this is just a quick question, but there is any way to validate azure blueprints?

Hi,

Creating a Logic App with managed identity, using Blueprint, doesn't work any more.
The blueprint works without the

"identity": {
  "type": "systemAssigned"
},

but fails if I add it back.
Using ARM Template directly from Azure Portal with the identity enabled works.

I'm not sure if it's the right place to submit the bug. If not, please advise where should I write
rgds!
Kinga

I've found the blueprint.json does accept arm specific json parameters BUT

"bpVMAdmin": {
    "type": "string",
    "defaultValue": "localvmadmin",
    "metadata": {
        "description": "Name des Admin Accounts",
        "displayname": "AdminAccount"
    },
    "allowedValues": [
        "localvmadmin",
        "bministrator"
    ]
},

this sample works correctly and shows the interface with a default value and a drop down to select the allowedValues from.

"bpVMAdmin": {
    "type": "string",
    "defaultvalue": "localvmadmin",
    "metadata": {
        "description": "Name des Admin Accounts",
        "displayname": "AdminAccount"
    },
    "allowedvalues": [
        "localvmadmin",
        "bministrator"
    ]
},

This parameter although does NOT show the dropdown nor does it show the default value. The values of the defaultvalue / allowedvalues are all lowercase... really?

This is not documented and it took me HOURS to understand and find the issue why some of my parameters showed default values, some of them not.

plz fix this!

BG Christoph

Hi! What kind of contributions can somebody make for blueprints?
Do you search for samples or PowerShell code?

Nothing criticial, but the param -Name is missing from the docs! Ill be sure to fork the repo and open a PR!

If I create a folder structure such as this, where two artifact files have the same name, only one artifact is registered.

artifacts
|_ artifact1/artifact.json
|_ artifact2/artifact.json

when deploying using the AZ CLI, I can't deploy with some vague error regarding properties.

When deploying via the portal using the imported blueprint, I had no issues.

Also, there are no docs on MS Docs for AZ CLI

Followed https://docs.microsoft.com/en-us/rest/api/blueprints/assignments/delete to find a way to delete assignments using REST APIs. The issue is that, when I use the API to delete the non-existent assignments without using the deleteBehavior param, it throws 204 - No Content error, which is right. But the same API when used with deleteBehavior param for deleting a non-existent assignment, it returns 202 status code.

Please see following issue opened since March 2020
Azure/azure-powershell#11245

In case Az context does not contain subscription this cmdlet will throw Import-AzBlueprintWithArtifact: Object reference not set to an instance of an object. upon attempt to upload blueprint.
This happens when service principal does not have direct Role Assignment on subscription level but have inherited assignment through management group. In this case Connect-AzAccount does not populate subscription info

Repro

Connect-AzAccount -ServicePrincipal -Credential $credentials -Tenant 65e4e06f-f263-4c1f-becb-90deb8c2d9ff

WARNING: The provided service principal secret will be included in the 'AzureRmContext.json' file found in the user profile ( C:\Users\artis\.Azure ). Please ensure that this directory has appropriate protections.

Account                              SubscriptionName TenantId                             Environment
-------                              ---------------- --------                             -----------
eccf917e-14e5-4493-b2b7-808444e4e890                  65e4e06f-f263-4c1f-becb-90deb8c2d9ff AzureCloud

PS C:\repo\DSO\DSO\DSO> Import-AzBlueprintWithArtifact -Name $env:BPNAME -InputPath "$($env:SYSTEM_DEFAULTWORKINGDIRECTORY)$($env:BLUEPRINTLOCATION)" -Force -ManagementGroupID $env:MANAGEMENTGROUPID 

Import-AzBlueprintWithArtifact: Object reference not set to an instance of an object.

policyDefinitionId or roleDefinitionId does not exist. If you are referencing a custom policy make sure that custom policy exists at or above the management group where the blueprint is saved. Custom role definitions are currently not supported for management groups.

without the apiVersion in the reference function, the template errors out when deployHub = false.

$response = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/' -Method GET -Headers @{Metadata="true"}
$content = $response.Content | ConvertFrom-Json
$accessToken = $content.access_token

Hi,

https://github.com/Azure/azure-blueprints/tree/master/assign-blueprint/as-template-deployment

What is the proper way to deploy such templates? It was failed using build.ps1

any advice would be appreciated.

Best
Jasmine

I'm looking for a sample for full blueprint definition that is arm-template based. I'm trying to use dynamic parameters in my blueprint and I'm have issues with it. It is behaving as static parameters once I deploy. I'm working with bicep and arm-template.

I'm deploying ARM template which I verified works as standalone as part of blueprint deployment and receiving non-descriptive error in portal. Exact error is below". Where do I exactly see "inner error"?

The template deployment '21da70219dee051cc9fe1d14cbe899f66a4a23029547adac93848e49c24eb832' is not valid according to the validation procedure. The tracking id is '6d7d8fcd-5693-42b8-9109-eb03dc9e385c'. See inner errors for details.

I get this error when I try to assign the blueprint to a subscription using REST API

There were error(s) encountered during the deployment:
Exceeded maximum wait time of '00:05:00'. Message: 'Either the Azure Blueprints service principal does not have owner permissions on the target subscription, or the system-assigned managed identity has not yet finished replicating.'.

I am certain that the issue is not coming because of service principal, as it is getting succeeded when I assign an empty blueprint to a subscription. Only when I try assigning a blueprint with artifacts, I get this issue. Also, this issue occurs like 50 % of the times.

When deploying front door using a blueprint, if the front door already exists it fails every time due to Permissions
The artifact 'xxxx-xxxxx-xxxxxx-xxxxxx' of type 'Template' failed to deploy due to the following error: Template deployment failed with error [
{
"code": "Forbidden",
"message": "{\r\n "error": {\r\n "code": "AuthorizationFailed",\r\n "message": "The client 'xxxxx-xxxxxxxx-xxxxx-xxxxx' with object id 'xxxxxx-xxxxxxx-xxxxxx-xxxxx' does not have authorization to perform action 'Microsoft.Network/frontdoors/write' over scope '/subscriptions/00000-000000-0000000-000000/resourcegroups/{resourceGroup}/providers/Microsoft.Network/frontdoors/{frontdoorname} or the scope is invalid. If access was recently granted, please refresh your credentials."\r\n }\r\n}"
}
]

Hi,

In the readme the link to "passed parameters inline to a nested deployment" links to google instead the suggested page.

Best regards,

Wouter

I know this is probably the wrong location but please point me to the correct repository.

Could variables please be enabled for blueprints? I'm able to specify variables in the Blueprint definition but if I try to use them in the blueprint I get the error that "function variables does not exist" or something to that effect. The issue is that we generate the resource group name based on the subscription name so I would like to compute the resource group name instead of having to write it but the computation is larger than 90 characters. If I could use variables I could break up the computation.
I realize you can add parameters to blueprints but values and default values for these seem to be ignored (at least in the portal) and I don't want to pass values.

Thanks for your time.

There are things here that should be reorganized https://github.com/Azure/azure-blueprints/tree/master/samples/001-builtins

As far as my understanding (after digging into Az.Blueprint PowerShell code base), the Import Artifact really recursively read into artifacts folder. I'd recommend to reorganize to make it more clear to read.

I've written a bit about deploying ASC through Azure Blueprint https://azsec.azurewebsites.net/2019/12/30/deploy-azure-security-center-blueprint/ and shared template here https://github.com/azsec/azure-blueprints/tree/master/AzureSecurityCenter

Thanks for your effort making a stable Azure Blueprint @alex-frankel

I am trying to configure tags for ResourceGroups from the blueprints and I am experiencing some issue.

In the example below I am want to parse the Tags as an object parameter:

{
  "properties": {
    "type": "Microsoft.Blueprint/blueprints",
    "description": "Management Blueprint",
    "targetScope": "subscription",
    "parameters": {
      "tags": {
        "type": "object",
        "metadata": {
          "displayName": "Enter the Tags that need to be configured"
        },
        "defaultValue": {
          "tags1": "value1",
          "tags2": "value2"
        }
      }
    },
    "resourceGroups": {
      "ResourceGroup1": {
        "name": "resourceGroup01",
        "location": "westeurope",
        "metadata": {
          "displayName": "resourceGroup01"
        },
        "dependsOn": [],
        "tags": "[parameters('tags')]"
      }
    }
  }
}

However, the above template returns the error message below:

Import-AzBlueprintWithArtifact: Can't deserialize the JSON file '/management/Blueprint.json'.  'Error converting value "[parameters('tags')]" to type 'System.Collections.Generic.IDictionary`2[System.String,System.String]'. Path 'tags', line 26, position 38.'

When I configure the Tags on ResourceGroup and use a String parameter as input it works fine:

{
    "properties": {
      "type": "Microsoft.Blueprint/blueprints" ,
        "description": "Management Blueprint",
        "targetScope": "subscription",
        "parameters": {
          "tagsvalue": {
            "type": "string",
            "defaultValue": "value1"
          }
        
        },
        "resourceGroups": {
              "ResourceGroup1": {
                "name": "resourceGroup01",
                "location": "westeurope",
                "metadata": {
                  "displayName": "resourceGroup01"
                },
                "dependsOn": [],
                "tags": {
                  "Tags1": "[parameters('tagsvalue')]"
                }
              }
        }
    }
  }

Is this a bug or is it not possible to forward an object to the Tags part?

Hello,

Is there a powershell command which will allow access to individual resources deployed via blueprint (same sort of information available in portal UI on Blueprint assignment page)?
Resources which are being deployed are using random names based off SubscriptionID,ResourceGroup as part of ARM template deployment so I need to be able to retrieve resulting name of resource which was deployed into subscription. I can not figure out how to do that.
Example I deploy SQL and name is coded as
"sqlServerName": "[tolower(concat(parameters('Organization_Name') , uniqueString(subscription().id, resourceGroup().id), '-sqlserver'))]",
How do I find out what was the name of sqlServerName from powershell once Blueprint finished assignment?

While using the sample pipeline the Assignment task fails. with error

** Assign Blueprint log: Get Blueprint <blueprintname>, version latest. **
##[error]Name '1' contains invalid characters.

The creatation is succesful and I am able to assign the blueprint in the portal.

Assignment looks like this:

{
    
    "identity": {
      "type": "SystemAssigned",
      "principalId": "<Id>",   //tried also without
      "tenantId": "<tenantid>" //tried also without
    },
    "location": "westeurope",
    "properties": {
      "blueprintId": "/subscriptions/<subscriptionId>/providers/Microsoft.Blueprint/blueprints/<blueprintname>/versions/4",
      "resourceGroups": {
        "vnetRG": {
          "name": "vnetRG",
          "location": "westeurope"
        },
        "mgmtRG": {
            "name": "mgmtRG",
            "location": "westeurope"
          }
      },
      "locks": {
        "mode": "none",
        "excludedPrincipals":null,
        "excludedActions":null
      },
      "parameters": {
        "VNET_location": {
          "value": "westeurope"
        },
        "VNET_vnetName": {
          "value": "<vnetname>"
        },
        "VNET_vnetAddressPrefix": {
            "value": ["10.10.0.0/20"]
        }
      }
    }
  }

Expectations are that it will show what will happen with deployment, that is resources created/update/deleted but nothing is being shown except What if: Performing the operation "Create blueprint assignment 'BP-Assign-Dev'" on target "90be46f1-376c-4619-8e6f-4a0635b86ab3".
Not sure what is the point of that operation.

There seems to be an issue when using the "SystemAssigned" identity for an assignment.

We are experiencing randomly failing deployments of arm templates when assigning a blueprint.

The assignment deployment fails with:

Status code: "Forbidden/AuthorizationFailed"
Status message:

The client 'x' with object id 'x' does not have authorization to perform action 'Microsoft.Security/securityContacts/write' over scope '/subscriptions/x' or the scope is invalid. If access was recently granted, please refresh your credentials.

We have verified that access rights are set up correctly. The assignment succeeds most of the time.

We see the same random failures with other resources as well (budget, vnets, etc). It also does not matter if we assign a new version or update it with the same version of the blueprint.

We have tried both from the portal and from Powershell.

We can't reproduce the issue when using an "UserAssigned" identity.

I have to assign a blueprint via Rest API

https://docs.microsoft.com/en-us/rest/api/blueprints/assignments/create-or-update#assignment-with-user-assigned-managed-identity-at-subscription-scope

How can I get token with managed identity? Managed Identity is like below:

{
"id": "/subscriptions/xxx-xxx-xxx/resourcegroups/xxxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/xxx",
"name": "xxx",
"type": "Microsoft.ManagedIdentity/userAssignedIdentities",
"location": "westeurope",
"tags": {},
"properties": {
"tenantId": "xxx",
"principalId": "xxx",
"clientId": "xxx"
}
}
The enterprise app that created with managed identity hasn't any client secret. How can I get token for assign the the blueprint via api?

Any advice would be appreciated.

I look into Azure Blueprint module (ResourceGroupDefinition class) and not sure why it allows max length 90 only.

"virtualMachineResourceGroup": {
    "name": "[concat(parameters('ags_projectCode'), '-', parameters('ags_projectStage'), '-vm', '-rg')]",
    "location": "[parameters('ags_resourceGroupLocation')]",
    "metadata": {
        "displayName": "Virtual Machine resource group"
    }
}

It should of allowed longer to satisfy complex naming convention. To fix the above issue I had to cut the total string length of name 's value. Replacing params with prefix ags by g as follows passed the validation

"virtualMachineResourceGroup": {
    "name": "[concat(parameters('g_projectCode'), '-', parameters('g_projectStage'), '-vm', '-rg')]",
    "location": "[parameters('ags_resourceGroupLocation')]",
    "metadata": {
        "displayName": "Virtual Machine resource group"
    }
}

I'd like to create a blueprint with target scope managementGroup.
The template should then have multiple resourceGroups for statically defined subscriptions.
Is this possible?

When I create a blueprint via portal the target scope is always subscription and I have to pick a subscription on assignment.
The az command fails completely:

$> az blueprint create -n mgmt-group-test -m "<hidden>" --target-scope managementGroup

(InvalidSchema) Path:properties.targetScope, Schema:#/definitions/SharedBlueprintProperties/properties/targetScope, Error: Value "managementGroup" is not defined in enum.
Code: InvalidSchema
Message: Path:properties.targetScope, Schema:#/definitions/SharedBlueprintProperties/properties/targetScope, Error: Value "managementGroup" is not defined in enum.

Confused with wording here https://docs.microsoft.com/en-us/azure/governance/blueprints/how-to/manage-assignments-ps#example-2-use-a-json-assignment-definition-file which using assignment file with published blueprint id as part of it. What is reason to have blueprint -Blueprint parameter in such cases since blueprint ID is already part of assignment file itself and is required (Example is below https://docs.microsoft.com/en-us/powershell/module/az.blueprint/new-azblueprintassignment?view=azps-5.2.0#example-4)