Deploy ARM template at management group scope with Azure DevOps Pipeline

Question

I want to deploy an ARM template on a management group via an Azure Devops pipeline task. I created a task based on the AzureResourceManagerTemplateDeployment@3 task. Below is my task in the pipeline YAML file.

- task: AzureResourceManagerTemplateDeployment@3
  inputs:
    deploymentScope: 'Management Group'                  
    azureResourceManagerConnection: 'My ARM Connection Name'
    location: 'East US'
    templateLocation: 'Linked artifact'
    csmFile: 'template.bicep'
    deploymentMode: 'Validation'

When I run the pipeline I get the error ##[error]Error: Task failed while initializing. Error: Endpoint data parameter ${ID} not present: ManagementGroupId

The AzureResourceManagerTemplateDeployment@3 task supports subscription, resource group, and management group deployment scope. Subscription level deployments have a parameter to provide the subscription ID, and resource group level deployments have a parameter for the resource group name. Management group level deployments don't seem to have any way to specify which management group to deploy the template.

I can deploy the template to a management group via the az cli by specifying the management group ID. Is there some way to make the pipeline task work or is this just a bug in the pipeline task?

Answer 1

As we all know:

• One Management Group can contain multiple Subscriptions.
• One Subscription can contain multiple Resource Groups.

When you set up an Azure Resource Manager service connection (ARM service connection), you can select the scope as either "Subscription" or "Management Group" on this connection. No other available scopes higher than "Management Group" on the connection.

• With the "Subscription" scope ARM service connection, you can deploy the resources to "Subscription" or "Resource Groups".
• With the "Management Group" scope ARM service connection, you can deploy the resources to "Management Group", "Subscription" or "Resource Groups".

When you set up an ARM service connection with "Management Group" scope, you need to provide the ID and Name of the Management Group.

When you use the connection to deploy resources to "Management Group", the task will automatically fetch the ID and Name of the Management Group that you have provided on the connection. So, you do not need to provide the information again on the task.

When you deploy resources to "Subscription" or "Resource Groups", as mentioned above, within the scope of the connection, it might contain multiple Subscriptions and Resource Groups. So, you need to specify the ID and Name of the target Subscription and Resource Group on the task.