Azure Done Right Series: Azure DevOps and Management Group Service Connections

Working in Azure DevOps requires a service connection to authenticate and deploy resources to Azure. Typically we scope this to a single Azure subscription.

Something that is useful and not as common is deploying to multiple subscriptions under a management group.

Creating a single service connection scoped to a management group removes the administrative overhead and enables us to deploy to any subscription in that management group. It does however require some different thinking and changes to our pipelines for successful deployments to occur.

It is also important to consider the security implications when using management group service connections and ensure it is properly secured within Azure DevOps.

If we were to deploy an ARM template using Azure DevOps we would use an Azure resource group deployment task in our Azure DevOps pipeline, which will typically look like the example below.

- task: AzureResourceGroupDeployment@2
  displayName: Azure Resource Group Deployment Example
    azureSubscription: AzureSubscriptionServiceConnection
    resourceGroupName: resource-group-name
    location: location
    csmFile: template-file-path
    csmParametersFile: template-parameter-file-path    
    deploymentMode: Incremental              

This works well with service connections scoped at the Azure subscription level, but will fail when using a service connection scoped at the management group level. This occurs as we haven’t specified which subscription we would like to deploy our resources into.

So how do we deploy ARM templates when using a management group service connection?

We won’t be able to utilise the built-in Azure resource group deployment task and we will need to use Azure PowerShell tasks instead to deploy our ARM templates.

When configuring the Azure PowerShell task we first we need to select the Azure subscription and then we can deploy our ARM template using the New-AzResourceGroupDeployment cmdlet.

An example is below.

- task: AzurePowerShell@5
  displayName: Management Group Deployment
    azuresubscription: ManagementGroupServiceConnection
    ScriptType: InlineScript
    Inline: |
        Select-AzSubscription -SubscriptionName subscription-name
        New-AzResourceGroupDeployment -ResourceGroupName resource-group-name -TemplateFile template-file-path -TemplateParameterFile template-parameter-file-path -Location location
    FailOnStandardError: true
    azurePowerShellVersion: LatestVersion
    pwsh: true

The same logic applies when deploying to Azure using management group service connections in Azure DevOps pipelines. We first need to select the subscription we want to work on and then execute our deployment, no matter the method whether it’s ARM templates, Azure CLI or Azure PowerShell.

[mailpoet_form id="1"]

Other Recent Blogs

Level 9, 360 Collins Street, 
Melbourne VIC 3000

Level 2, 24 Campbell St,
Sydney NSW 2000

200 Adelaide St,
Brisbane QLD 4000

191 St Georges Terrace
Perth WA 6000

Level 10, 41 Shortland Street

Part of

Arinco trades as Arinco (VIC) Pty Ltd and Arinco (NSW) Pty Ltd. © 2023 All Rights Reserved Arinco™ | Privacy Policy
Arinco acknowledges the Traditional Owners of the land on which our offices are situated, and pay our respects to their Elders past, present and emerging.

Get started on the right path to cloud success today. Our Crew are standing by to answer your questions and get you up and running.