Trouble Assigning Cosmos DB Operator Role to User-Assigned Managed Identity via ARM Template

Djordje Djukic (AKVELON INC) 0 Microsoft Vendor

Hi Azure Community,

I'm currently working on assigning the Cosmos DB Operator role to a user-assigned managed identity using an ARM template. Despite following the documentation, I'm encountering a "not found" error, and I'm not sure what I'm doing wrong.

Thanks in advance.

{
      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
      "apiVersion": "2021-05-15",
      "name": "[concat(variables('cosmosDbAccountName'), '/', guid('roleAssignment1', 'data'))]",,
      "dependsOn": [
        "[concat('Microsoft.DocumentDB/databaseAccounts/', variables('cosmosDbAccountName'))]",
        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('identityName'))]"
      ],
      "properties": {
        "roleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', variables('cosmosDbAccountName'), '230815da-be43-4aae-9cb4-875f7bd000aa')]",
        "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('identityName'))).PrincipalId]",
        "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', variables('cosmosDbAccountName'))]"
      }
 }

Oury Ba-MSFT 17,631 Reputation points Microsoft Employee

2024-06-07T23:35:34.7466667+00:00
@Djordje Djukic (AKVELON INC) Thank you for reaching out.If you create a new service principal and immediately try to assign a role to that service principal, that role assignment can fail in some cases. For example, if you create a new managed identity and then try to assign a role to that service principal in the same Azure Resource Manager template, the role assignment might fail. The reason for this failure is likely a replication delay. The service principal is created in one region; however, the role assignment might occur in a different region that hasn't replicated the service principal yet.

To address this scenario, you should set the principalType property to ServicePrincipal when creating the role assignment. You must also set the apiVersion of the role assignment to 2018-09-01-preview or later. 2022-04-01 is the first stable version.

The following template demonstrates:

How to create a new managed identity service principal

How to specify the principalType

How to assign the Contributor role to that service principal at a resource group scope

To use the template, you must specify the following inputs:

The base name of the managed identity, or you can use the default stringIf you create a new service principal and immediately try to assign a role to that service principal, that role assignment can fail in some cases. For example, if you create a new managed identity and then try to assign a role to that service principal in the same Azure Resource Manager template, the role assignment might fail. The reason for this failure is likely a replication delay. The service principal is created in one region; however, the role assignment might occur in a different region that hasn't replicated the service principal yet.

To address this scenario, you should set the principalType property to ServicePrincipal when creating the role assignment. You must also set the apiVersion of the role assignment to 2018-09-01-preview or later. 2022-04-01 is the first stable version.

Please see example https://video2.skills-academy.com/en-us/azure/role-based-access-control/role-assignments-template#new-service-principal

Share via

Trouble Assigning Cosmos DB Operator Role to User-Assigned Managed Identity via ARM Template