azure - RBAC with bicep - Stack Overflow

admin管理员组

文章数量:1122846

Im trying to assing the AD group to my storage account as contributor and also storage blob data contributor using the Servicie principal that is owner at sub level.

param storageAccountName string
param roleId array
param adGroup string
param principalType string = 'Group'

// reference to storage account
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

resource roleAssignment1 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for roleId in roleId:  {
  name: guid(subscription().subscriptionId, resourceGroup().name, storageAccountName, roleId, adGroup)
  scope: storageAccount
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleId)
    principalId: adGroup
    principalType: principalType
  }
}
]

I get this error

code":"GroupTypeNotSupported","message":"Only security-enabled groups can be used in role assignments."}

Im trying to assing the AD group to my storage account as contributor and also storage blob data contributor using the Servicie principal that is owner at sub level.

param storageAccountName string
param roleId array
param adGroup string
param principalType string = 'Group'

// reference to storage account
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' existing = {
  name: storageAccountName
}

resource roleAssignment1 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for roleId in roleId:  {
  name: guid(subscription().subscriptionId, resourceGroup().name, storageAccountName, roleId, adGroup)
  scope: storageAccount
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleId)
    principalId: adGroup
    principalType: principalType
  }
}
]

I get this error

code":"GroupTypeNotSupported","message":"Only security-enabled groups can be used in role assignments."}

• azure
• azure-resource-manager
• azure-bicep
• azure-rbac

Share Improve this question Follow edited Nov 21, 2024 at 19:18 Thomas 29.3k66 gold badges9898 silver badges139139 bronze badges Recognized by Microsoft Azure Collective asked Nov 21, 2024 at 18:34 play_something_goodplay_something_good 13111 silver badge1111 bronze badges 4

• 1 The group need to be of type "security". You can check the type in MS Entra – Thomas Commented Nov 21, 2024 at 18:44
• it syas Microsoft 365 :/ – play_something_good Commented Nov 21, 2024 at 18:46
• @Thomas after changing to different AD Group which is type Security, i ge tthis error "code":"RoleAssignmentUpdateNotPermitted","message":"Tenant ID, application ID, principal ID, and scope are not allowed to be updated" – play_something_good Commented Nov 21, 2024 at 19:01
• 1 if you already created manually the role assignment, a random guid was assigned so when running your bicep file, it will try to create a new role assignment with a different name guid(subscription().subscriptionId, resourceGroup().name, storageAccountName, roleId, adGroup). Delete the existing role assignment first and create it again using bicep. – Thomas Commented Nov 21, 2024 at 19:11

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 1

Only MS Entra group of Type Security can be assigned. You can check the group type in MS Entra.
Once you've updated the group type, it should work.

Note: if you've created manually the role assignment, a random guid was assigned so when running your bicep file, it will try to create a new role assignment with a different name (guid(subscription().subscriptionId, resourceGroup().name, storageAccountName, roleId, adGroup). Delete the existing role assignment first and create it again using bicep.

本文标签： azureRBAC with bicepStack Overflow