Azure / Azure/arm-template-whatif

Problem when RP is not register and using -WhatIf parameter

Open
#86 6 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
HTML
Stars
101
Forks
21
Avg merge
3h 35m
Merged PRs (30d)
1

Description

**Describe the bug**
When you run deployment with -WhatIf parameter set to false or true on a new subscription where the resource provider for the deployed resources is not registered the command will fail with:
The subscription must be registered to use namespace 'Microsoft.ManagedServices'.
The whole error is:

```
Error:
DeploymentWhatIfResourceError - Long running operation failed with status 'Failed'. Additional Info:'The request to predict template deployment changes to subscription '' has failed due to a resource error. See details for more information.'
MissingSubscriptionRegistration - The managed services resource provider not allowed to access the subscription ''. The subscription must be registered to use namespace 'Microsoft.ManagedServices'. Please see https://aka.ms/rp-not-register-error for details on how to register subscriptions.
AuthorizationFailed - The client '' with object id '' does not have authorization to perform action 'Microsoft.Resources/subscriptions/read' over scope '/subscriptions/' or the scope is invalid. If access was recently granted, please refresh your credentials.

```

This works perfectly fine if the -WhatIf parameter is completely missing.
For authentication I am using access token which is generated by refresh token. The refresh token is generated by Azure AD app registration that impersonates user that has Admin Agent (AOBO) (CSP scenario). New-AzSubscriptionDeployment should work the same way no matter if you are using -WhatIf parameter or not.

**Client** [e.g. PowerShell, CLI, API)
Powershell

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce New-AzSubscriptionDeployment on a new subscription with -WhatIf set to true and false, using the described access-token authentication, then compare it with a deployment that omits -WhatIf. Investigate the reported Microsoft.ManagedServices registration, subscription-read authorization, and DeploymentWhatIfResourceError details; done when WhatIf and normal deployment behave consistently for the same credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.