Client-AzureOnboard.json

{
   "$schema": "https://schema.management.azure.com/schemas/2019-08-01/subscriptionDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "mspOfferName": {
            "type": "string",
            "metadata": {
                "description": "Specify a unique name for your offer"
            },
            "defaultValue": "IT Partners - Managed Services"
        },
        "mspOfferDescription": {
            "type": "string",
            "metadata": {
                "description": "Name of the Managed Service Provider offering"
            },
            "defaultValue": "IT Partners Limited, Microsoft Azure Managed Services"
        },
        "managedByTenantId": {
            "type": "string",
            "metadata": {
                "description": "Specify the tenant id of the Managed Service Provider"
            },
            "defaultValue": "aa848a4d-fe9e-4b2f-b64a-a95a1e8b44e9"
        },
        "authorizations": {
            "type": "array",
            "metadata": {
                "description": "Specify an array of objects, containing tuples of Azure Active Directory principalId, a Azure roleDefinitionId, and an optional principalIdDisplayName. The roleDefinition specified is granted to the principalId in the provider's Active Directory and the principalIdDisplayName is visible to customers."
            },
            "defaultValue": [
                {
                    "principalId": "288dcb75-c397-4ade-9526-56554d208a71",
                    "roleDefinitionId": "acdd72a7-3385-48ef-bd42-f606fba81ae7",
                    "principalIdDisplayName": "AAD-ITP-Clients-MS-AZ-Reader"
                },
                   {
           "principalId": "08afa2f6-c1f6-49e5-aa6a-eff6dc49be2e",
           "roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c",
           "principalIdDisplayName": "Provider Automation Account"
          }
            ]
        },
        "eligibleAuthorizations": {
            "type": "array",
            "metadata": {
                "description": "Provide the auhtorizations that will have just-in-time role assignments on customer environments with support for approvals from the managing tenant"
            },
            "defaultValue": [
                {
                    "justInTimeAccessPolicy": {
                        "multiFactorAuthProvider": "Azure",
                        "maximumActivationDuration": "PT8H"
                    },
                    "principalId": "23da7840-fae5-44ab-8a52-101d0c334c58",
                    "roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c",
                    "principalIdDisplayName": "AAD-ITP-Clients-MS-AZ-Contributor"
                },
                {
                    "justInTimeAccessPolicy": {
                        "multiFactorAuthProvider": "Azure",
                        "maximumActivationDuration": "PT8H"
                    },
                    "principalId": "23da7840-fae5-44ab-8a52-101d0c334c58",
                    "roleDefinitionId": "91c1777a-f3dc-4fae-b103-61d183457e46",
                    "principalIdDisplayName": "AAD-ITP-Clients-MS-AZ-Contributor"
                },
                {
                    "justInTimeAccessPolicy": {
                        "multiFactorAuthProvider": "Azure",
                        "maximumActivationDuration": "PT8H"
                    },
                    "principalId": "23da7840-fae5-44ab-8a52-101d0c334c58",
                    "roleDefinitionId": "e40ec5ca-96e0-45a2-b4ff-59039f2c2b59",
                    "principalIdDisplayName": "AAD-ITP-Clients-MS-AZ-Contributor"
                },
                {
                    "justInTimeAccessPolicy": {
                        "multiFactorAuthProvider": "Azure",
                        "maximumActivationDuration": "PT8H"
                    },
                    "principalId": "1a4cc546-fda8-45c5-8e8b-0d743c9095dd",
                    "roleDefinitionId": "9980e02c-c2be-4d73-94e8-173b1dc7cf3c",
                    "principalIdDisplayName": "AAD-ITP-Clients-MS-AZ-Operator"
                },
                 {
                    "justInTimeAccessPolicy": {
                        "multiFactorAuthProvider": "Azure",
                        "maximumActivationDuration": "PT8H"
                    },
                    "principalId": "1a4cc546-fda8-45c5-8e8b-0d743c9095dd",
                    "roleDefinitionId": "00c29273-979b-4161-815c-10b084fb9324",
                    "principalIdDisplayName": "AAD-ITP-Clients-MS-AZ-Operator"
                },
                {
                    "justInTimeAccessPolicy": {
                        "multiFactorAuthProvider": "Azure",
                        "maximumActivationDuration": "PT8H"
                    },
                    "principalId": "1a4cc546-fda8-45c5-8e8b-0d743c9095dd",
                    "roleDefinitionId": "4fe576fe-1146-4730-92eb-48519fa6bf9f",
                    "principalIdDisplayName": "AAD-ITP-Clients-MS-AZ-Operator"
                },
                {
                    "justInTimeAccessPolicy": {
                        "multiFactorAuthProvider": "Azure",
                        "maximumActivationDuration": "PT8H"
                    },
                    "principalId": "1a4cc546-fda8-45c5-8e8b-0d743c9095dd",
                    "roleDefinitionId": "749f88d5-cbae-40b8-bcfc-e573ddc772fa",
                    "principalIdDisplayName": "AAD-ITP-Clients-MS-AZ-Operator"
                }
            ]
        }
    },
    "variables": {
        "mspRegistrationName": "[guid(parameters('mspOfferName'))]",
        "mspAssignmentName": "[guid(parameters('mspOfferName'))]"
    },
    "resources": [
        {
            "type": "Microsoft.ManagedServices/registrationDefinitions",
            "apiVersion": "2020-02-01-preview",
            "name": "[variables('mspRegistrationName')]",
            "properties": {
                "registrationDefinitionName": "[parameters('mspOfferName')]",
                "description": "[parameters('mspOfferDescription')]",
                "managedByTenantId": "[parameters('managedByTenantId')]",
                "authorizations": "[parameters('authorizations')]",
                "eligibleAuthorizations": "[parameters('eligibleAuthorizations')]"
            }
        },
        {
            "type": "Microsoft.ManagedServices/registrationAssignments",
            "apiVersion": "2020-02-01-preview",
            "name": "[variables('mspAssignmentName')]",
            "dependsOn": [
                "[resourceId('Microsoft.ManagedServices/registrationDefinitions/', variables('mspRegistrationName'))]"
            ],
            "properties": {
                "registrationDefinitionId": "[resourceId('Microsoft.ManagedServices/registrationDefinitions/', variables('mspRegistrationName'))]"
            }
        }
    ],
    "outputs": {
        "mspOfferName": {
            "type": "string",
            "value": "[concat('Managed by', ' ', parameters('mspOfferName'))]"
        },
        "authorizations": {
            "type": "array",
            "value": "[parameters('authorizations')]"
        },
        "eligibleAuthorizations": {
            "type": "array",
            "value": "[parameters('eligibleAuthorizations')]"
        }
    }
}