Need help for subscription creation at azure tenant enterprise scale set

[Mohansharma84]

Need help for subscription creation at azure tenant enterprise-scale set

[brwilkinson]

You can review the docs here: https://github.com/Azure/data-management-zone

Including the pre-req steps here: https://github.com/Azure/data-management-zone#deploy-data-management-zone

[brwilkinson]

Also here: https://github.com/Azure/Enterprise-Scale/blob/main/docs/EnterpriseScale-Setup-azure.md

[azMantas]

to create a subscription you need to have access to EA account id. Once you have that ID, I believe that this snippet can help you

targetScope = 'managementGroup'

param SubscriptionName string = 'bicepRules'
param DisplayName string = 'bicep-rules-test'

@description('For billingScope, provide the enrollment account ID.')
param BillingScope string 

resource subscription 'Microsoft.Subscription/aliases@2020-09-01' = {
  name: SubscriptionName
  scope: tenant()
  properties: {
    billingScope: BillingScope
    displayName: DisplayName
    workload: 'Production'
  }
}

run Azure cli az billing account list to get billing account id

[Mohansharma84]

Hi azMantas

Thanks for your help but have still doubt to create/refactoring the subscriptions of existing management/sub management groups which are already created by another module.

I have the below scenario.

• Management Groups already created
• refactring exiting subscription
  -associate the subscription with respective management group

[brwilkinson]

@Mohansharma84

So I think I understand what you are asking ... I will do this in 2 parts

1. extract and deploy management groups
2. extract and deploy subscriptions under management groups

you have something like below

i.e. a list of Management Groups.

You can export these to a hierarchy with PowerShell

Get-AzManagementGroup -WarningAction SilentlyContinue | 
foreach {Get-AzManagementGroup -WarningAction SilentlyContinue -GroupName $_.Name -Expand } | 
select Name,ParentName 

Name                                 ParentName
----                                 ----------
11cb9e1b-bd08-4f80-bb8f-f71940c39079 
HA-APP                               11cb9e1b-bd08-4f80-bb8f-f71940c39079
HA-APP-decommissioned                HA-APP
HA-APP-landingzones                  HA-APP
HA-APP-management                    HA-APP-platform
HA-APP-online                        HA-APP-landingzones
HA-APP-platform                      HA-APP
HA-APP-sandboxes                     HA-APP

from that you can create your declarative json definition for your parameter file for your Bicep Templates

Get-AzManagementGroup -WarningAction SilentlyContinue | 
foreach {Get-AzManagementGroup -WarningAction SilentlyContinue -GroupName $_.Name -Expand } | 
select Name,DisplayName,ParentName | convertto-json

This goes in your parameter file

Now you can create your MG deployment template to be able to redeploy out the MG's with the exact same hierarchy that you exported.

Example Template for a Management Group Deployment into the Root Management Group.

• loop through the above management group definitions 1 at a time, set them with the correct parent.
  • this should reflect what you already have since you exported it
  • you can also add more.
  • ensure you deploy into root management scope

$MGName = Get-AzManagementGroup | where displayname -eq 'Root Management Group' | foreach Name
New-AzManagementGroupDeployment @Common @TemplateArgs @OptionalParameters -ManagementGroupId $MGName

https://github.com/brwilkinson/AzureDeploymentFramework/blob/84bc4ecd82dec7e19e68639ead90f75132059a56/ADF/bicep/man-MG.bicep#L57

targetScope = 'managementGroup'

var mgInfo = contains(DeploymentInfo, 'mgInfo') ? DeploymentInfo.mgInfo : []

var managementGroupInfo = [for (mg, index) in mgInfo: {
  match: ((Global.CN == '.') || contains(Global.CN, mg.name))
}]

@batchSize(1)
module mgInfo_displayName 'man-MG-ManagementGroups.bicep' = [for (mg,index) in mgInfo: if (managementGroupInfo[index].match) {
  name: 'dp-${mg.name}'
  params: {
    mgInfo: mg
  }
}]

Which calls the actual Module that does the work:
https://github.com/brwilkinson/AzureDeploymentFramework/blob/84bc4ecd82dec7e19e68639ead90f75132059a56/ADF/bicep/man-MG-ManagementGroups.bicep#L10

param mgInfo object

targetScope = 'managementGroup'

resource parentMG 'Microsoft.Management/managementGroups@2021-04-01' existing = {
  name: mgInfo.ParentName
  scope: tenant()
}

resource MG 'Microsoft.Management/managementGroups@2021-04-01' = {
  name: mgInfo.name
  scope: tenant()
  properties: {
    displayName: mgInfo.displayName
    details: {
      parent: mgInfo.parentName == null ? null : /*
      */  {
            id: parentMG.id
          }
    }
  }
}

I would recommend to do the above First, then come back to this second phase.

Now export the same again, however this time with the Subscriptions as well.

Get-AzManagementGroup -WarningAction SilentlyContinue | 
    ForEach-Object { 
        Get-AzManagementGroup -WarningAction SilentlyContinue -GroupName $_.Name -Expand } | 
    ForEach-Object {
        $Path = '/providers/Microsoft.Management/managementGroups/{0}/subscriptions?api-version=2020-05-01' -f $_.Name
        $r = Invoke-AzRestMethod -Path $path -Method GET | ForEach-Object content | ConvertFrom-Json | ForEach-Object value
        $Subscriptions = $r | ForEach-Object { $_.name }
        
        @{
            name          = $_.Name
            displayName   = $_.DisplayName
            parentName    = $_.ParentName
            subscriptions = @($Subscriptions)
        }
    } | convertto-json

This time you have the same thing, plus also the subscriptions under each Management Group

So now just add this extra step the your template above.

Docs reference
https://docs.microsoft.com/en-us/azure/templates/microsoft.management/2021-04-01/managementgroups/subscriptions?tabs=bicep

Sample
https://github.com/brwilkinson/AzureDeploymentFramework/blob/c549e100c51cbd23da323bd680e6113767f25bae/ADF/bicep/man-MG-ManagementGroups.bicep#L24

resource subscriptions 'Microsoft.Management/managementGroups/subscriptions@2021-04-01' = [for (sub, index) in mgInfo.subscriptions: {
  name: sub
  parent: MG
}]

You can view the deployments under the Root Management Deployments

Including where the subscription was assigned under the individual MG deployment

Deploy again... instead of this

Use this

instead of this

you get this

The export powershell script is here:
https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/1-PrereqsToDeploy/0-Get-AzManagementGroupSubscriptions.ps1

Assuming you have a different process in place to create subscriptions in the first place.

[brwilkinson]

@Mohansharma84
Ping, ... just wanted to ensure you saw the response.

[brwilkinson]

Marking as answered, feel free to continue the conversation if you would like some further info or guidance.