Azure Landing Zone Accelerator ARM template deployment failing:

[akn9050]

Describe the bug
Following ARM template deployment is failing: https://portal.azure.com/#blade/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2FeslzArm.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2Feslz-portal.json

• Redeploying the template with same impute values is also not working:

Error Message:

{
    "status": "Failed",
    "error": {
        "code": "RoleAssignmentUpdateNotPermitted",
        "message": "Tenant ID, application ID, principal ID, and scope are not allowed to be updated."
    }
}

Steps to reproduce

1. Deploy the template
   https://portal.azure.com/#blade/Microsoft_Azure_CreateUIDef/CustomDeploymentBlade/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2FeslzArm.json/uiFormDefinitionUri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FEnterprise-Scale%2Fmain%2FeslzArm%2Feslz-portal.json

Screenshots

[jtracey93]

Hi @akn9050,

It looks like the environment you are deploying into may of had an ESLZ deployment into it before that was not cleaned up fully.

And now you are deploying with different input parameters than you did on a previous deployment.

Make sure you cleanup the previous deployment fully and then re-run ESLZ deployment and it should be fine.

For this example it is trying to create a role assignment on the connectivity subscription that already exists (from a previous deployment) and it is correctly stating it cannot update it as it already exists with different properties.

The role assignment name/guid is created from the top level management group prefix and the role defintion, which in this case is the network contributor. As shown here:

Enterprise-Scale/eslzArm/managementGroupTemplates/roleAssignments/roleAssignment.json

Line 26 in c8210c0

"name": "[guid(concat(parameters('topLevelManagementGroupPrefix'), parameters('roleDefinitionId')))]",

If you remove the role assignments on the connectivity subscription for network contributor from previous deployments, this should resolve it for you.

Let us know

Thanks

Jack

[akn9050]

HI @jtracey93,

Thanks it resolved the issue, there were few identity not found role assignments, after removing those and redeploying the template, deployment got succeed.

Thanks for the quick help :)

[jtracey93]

No worries at all, happy to help 👍👍👍