feat(hubs): add resourceGroupTags for internal test deployments - #2289
Draft
Michael Flanakin (flanakin) wants to merge 2 commits into
Draft
feat(hubs): add resourceGroupTags for internal test deployments#2289Michael Flanakin (flanakin) wants to merge 2 commits into
Michael Flanakin (flanakin) wants to merge 2 commits into
Conversation
Adds an optional resourceGroupTags Bicep parameter that merges tags onto the resource group the hub template deploys into (main.bicep is resource-group scoped and has no other way to touch the RG's own tags). Uses Microsoft.Resources/tags, not a deploymentScript, so it doesn't provision an ACI and can't hit the timeout it exists to work around. Intended for Microsoft FTEs deploying internal test hubs that need a resource-group-level policy tag -- most commonly SecurityControl=Ignore to bypass tenant security policies (e.g. SFI) that block deployment scripts from using storage account shared keys, causing DeploymentScriptACIProvisioningTimeout (#2241, #1816). No portal UI change: createUiDefinition.json configures the deployment target, not the resource group the portal already created before the template runs, so a portal checkbox can't express this. Deliberately Bicep-parameter-only (CLI/PowerShell-visible) so it doesn't add UI clutter for the vast majority of deployments that will never need it. Documents the parameter and both ways to set the tag (az group create/update, or the new parameter) in the DeploymentScriptACIProvisioningTimeout troubleshooting entry. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
microsoft-github-policy-service
Bot
requested a review
from Brett Wilson (MSBrett)
August 26, 2026 20:28
microsoft-github-policy-service
Bot
added
the
Needs: Review 👀
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
resourceGroupTagsparameter tomain.bicepthat merges tags onto the resource group the hub deploys intomain.bicepis resource-group scoped, so it has no other way to touch the RG's own tags — the existingtags/tagsByResourceparams only tag resources inside the RG, which doesn't affect ACI provisioningMicrosoft.Resources/tags(a plain ARM resource), not a deploymentScript — it doesn't provision an ACI itself, so it can't hit the timeout it's meant to help work aroundunion(resourceGroup().tags, resourceGroupTags)rather than replacing, so it won't clobber any tags already required by the target subscription's own policyWhy
Requested in #2241 (
DeploymentScriptACIProvisioningTimeout) as a way for Microsoft FTEs to deploy internal test hubs withSecurityControl=Ignoreset on the resource group, which works around tenant security policies (SFI) blocking deployment scripts from using storage account shared keys — the same root cause diagnosed in #1816. Only one internal tag is known/documented (SecurityControl=Ignore); the parameter accepts an arbitrary tag object so others can be added later without another template change.No portal UI change:
createUiDefinition.jsonconfigures the deployment target, not the resource group the portal already created before the template runs — a portal checkbox literally can't express "tag the resource group." This is deliberately Bicep-parameter-only (CLI/PowerShell-visible, not portal-visible) so it stays out of the way for public deployers who don't need it.Test plan
bicep buildcompiles cleanSecurityControl=Ignoreis documented anywhere in this repo's history; searched issues/discussions/code exhaustively)Related: #2241, #1816
🤖 Generated with Claude Code