Subscription scope function

[azureiac]

Hi Team,

I have use case to deploy vnet to different subscription using subscription name ( not subscription id)

I have added below function in scope under my module

subscription(last(split(tenantResourceId('Microsoft.Subscription/aliases', sub.subscriptionName), '/')))

I am passing subscriptionName under my parameter file

FYI I am using service connection on management group to deploy into different subscription under it.

Please guide on this.

main.bicep

targetScope = 'managementGroup'

param subscriptions array

module rg 'RG.bicep' = [for sub in subscriptions: {
  name: sub.subscriptionName
  scope: subscription(last(split(tenantResourceId('Microsoft.Subscription/aliases', sub.subscriptionName), '/')))
  params: {
    rgName: sub.rgName
    location: sub.location
    vnet : sub.vnet
  }
}]

RG.bicep

targetScope = 'subscription'

param rgName string
param location string
param vnet object

resource resgroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
  name: rgName
  location: location
}
module network 'network.module.bicep' =  {
  name: 'rgdeploy'
  scope: resourceGroup(rgName)
  params: {
    vnet:vnet
  }
dependsOn: [
  resgroup
]
}

parameters.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
      "subscriptions": {
          "value": [
              {
                  "subscriptionName": "es-corporate",
                  "rgName": "rg-corp-lz-network-we",
                  "environment": "dev",        
                  "vnet": {
                        "name": "vnet-corp-lz-we",
                        "addressPrefix": "xxxxx",
                        "subnets": [
                          {
                            "name": "snet-corp-lz-dev-001",
                            "addressPrefix": "xxxxxx"
                          }
                        ]
                      },
                  "location" :"westeurope"
              }
          ]
      }
  }
}

[alex-frankel]

Unfortunately, alias names are not a valid input for subscriptions. That API was created to create new subscriptions, but that alias value is not used in other contexts. IOW, it's a vehicle to get a subscription GUID, which is what you need to perform any further actions with that subscription.

[azureiac]

@alex-frankel : thanks for reply .Using subscription(subscriptionId) scope function I already managed to complete deployment but use case is that subscription id changes in every environment.

If I keep subscription name common in every environment as per enterprise scale model Connectivity Subscription, Landing Zone Subscription etc. We thought we don't need to pass subscription id in parameters file for every environment.

[alex-frankel]

Makes sense. This indirection would definitely be very useful for abstracting away subscription GUIDs (in addition to making some other scenarios easier). We've had the ask before, but this extra context helps with further prioritization.

[alex-frankel]

We have an internal work item tracking this, so keeping a link to that here for reference:
https://msazure.visualstudio.com/One/_workitems/edit/7811732

[brwilkinson]

@azureiac

So i have been wondering how to handle this request for some time.

Now I am wondering are you looking to use the Subscription DisplayName to select the subscription ?

e.g.

$Search = 'BENWILK'
Invoke-azRestMethod -Method GET -Uri https://management.azure.com/subscriptions?api-version=2021-01-01 | foreach content | convertfrom-json | foreach value | where displayname -match $Search


id                   : /subscriptions/b8f402aa-20f7-4888-b45c-3cf086dad9c3
authorizationSource  : Legacy, RoleBased
managedByTenants     : {}
subscriptionId       : b8f402aa-20f7-4888-b45c-3cf086dad9c3
tenantId             : 72f988bf-86f1-41af-91ab-2d7cd011db47
displayName          : MSFT BENWILK AIRS                  #<-- displayname from search
state                : Enabled

I originally had thought that the subscription alias was the same as the displayname, however I realize that it is not.

So the issue here is that I am sure you can have duplicate displaynames and also there is no guarantee that no one has changed the displayname. So basically the subscription GUID is the reliable way to lookup a subscripiton.

If you are using Landing Zones to pre-create the subscriptions and the displaynames and then you want to look up a subscription guid from the displayname I think that could be reliable, given you own the whole process, however once it was handed over, someone can just come along and update the dusscription displayname.

So let me know if you still have this ask?

If you do, I think we could figure out how to call the list subscriptions and filter on the displayname and then return the guid, if it was within Bicep or within a deployentScript executed from Bicep.

[brwilkinson]

Going to close this, however feel free to respond and I can implement and workaround via deploymentScript.

[Kolbasz12]

I know this was closed, but did we ever find a good workaround after the fact? The goal is to reference and scope to subscriptions, without having to hard code GUID ids into parameter files. It would be nice if there was a better way. Perhaps it is a matter of a deployment script as suggested.

My one thought, is with a deployment script, you are referencing subscriptions in the script and you need separate deployment scripts on top of the separate parameters files. If there is an idea to have a universal script, I would love to hear it.

[olegd-superoffice]

@brwilkinson So there's no workaround for this yet? My use case is to deploy management group with a bunch of subscriptions and enable Defender for Cloud on all those subscriptions. So I have a template with targetScope = 'managementGroup' which creates subscription aliases and for each alias it creates I need to run a module with targetScope = 'subscription'. Is this possible at all?