Create new resources manually on managed resource groups

[FlorOtero]

I'd like to know if its possible to make changes on a manged resource group - meaning the customer being able to deploy new resources on the managed resource group? I know that the managed applications have a deny asssignment.

Additionally, it is possible to get the managed resource group name and application name as output on the createUiDefinition?

Thanks in advance

[scseely]

By default, a ManagedApplication only gives the user read access to the managed resource group. This permission is defined as */read. You can give additional permissions via AllowedActions (eg. give access to all Storage options via Microsoft.Storage/storageAccounts/*).

The Managed Resource Group name and location are available to the ARM template via the resourceGroup() function. 

The application name is available post deployment. You can also simply ask the user for the name to display in a separate box, allowing them to duplicate the string as necessary.

[FlorOtero]

Hi @scseely thanks for your answer

I've added on the Customer Allowed actions `/write` permissions but when I try to deploy something I receive the following error:

The client ... with object id '.. has permission to perform action '*/write' on scope '/resourceGroups/mrg**/'; however, the access is denied because of the deny assignment with name 'System deny assignment created by managed application

It's possible that the deny assignment overrides the permission?

thanks!

[brian_levenson]

Hi Florencia - I don't believe this is possible; however, I'm confirming with our architect team.

It is possible to define allowed control actions and data actions, though.

[Andra]

Hi @FlorOtero ,

thank you for the additional details!

I moved your query in the Microsoft AppSource and Azure Marketplace forum for more visibility.

While I don`t have this level of information, hopefully partners and SMEs on this forum can advise.

Thanks,

Andra

[Andra]

Hi @FlorOtero ,

Thanks for your query!

This documentation might help.

💡 Tip: you might want to check this information with the Tech Community as well. 😊

Have a great day ahead,

Andra

[FlorOtero]

Hi @Andra, thanks for your answer

My need is to publish managed applications on the commertial marketplace, but I need for the clients to be able to deploy extra resources on the managed resource group created by the managed application. Is there a way to enable this on the partner center? Or any configuration? I'm aware that the resource group is by default created with a System Deny Assignment policy.

Thanks!

[santhosh]

Hi @FlorOtero ,

Can you try providing more permissions on Allowed customer actions?

[FlorOtero]

Hi @santhosh, thanks for your answer

I've added `/write` permissions but when I try to deploy something I receive the following error

The client ... with object id '.. has permission to perform action '*/write' on scope '/resourceGroups/mrg****/'; however, the access is denied because of the deny assignment with name 'System deny assignment created by managed application