Azure / Azure/bicep

Unable to use Microsoft.Management/serviceGroups as a resource scope

Open
#18,097 0 comments 0 reactions 1 assignee Claimed by @subha-sa View on GitHub
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

**Bicep version**
All

**Describe the bug**

```bicep
var sgName = 'mySG'

resource sg 'Microsoft.Management/serviceGroups@2024-02-01-preview' existing = {
name: sgName
scope: tenant()
}

resource site 'Microsoft.Edge/sites@2025-03-01-preview' = {
scope: sg
name: 'MySite'
properties: {}
}
```

should produce the following scope on the site resource

```json
"scope": "[format('/providers/Microsoft.Management/serviceGroups/{0}', variables('sgName'))]",
```

but it produces

```json
"scope": "[format('Microsoft.Management/serviceGroups/{0}', variables('sgName'))]",
```

Because it's not absolute, it inherits the scope of the deployment. In the reported case, this was an RG deployment and user is unable to issue a tenant level deployment due to lack of permissions.

Suggested workaround was to compile the Bicep into an ARM template and make the manual edit, but this looks like a gap in support for service groups.

**Additional context**
This is a repair item created from an internal incident.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.