Managed application deployment failes when policy configured at resource group level

Question

I deployed managed application definition by referring https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.solutions/managed-application as a service catalog application.

When I try to deploy managed application to subscription it fails with error disallowed by Policy. This subscription has policy configured on resource group to have Owner Tag.
Although mainTemplate of managed application is configured with
{
"type": "Microsoft.Resources/tags",
"name": "default",
"apiVersion": "2021-04-01",
"properties": {
"tags": {
"Owner": "ABCD"}
}
}

Is it possible to create managed resource group with proper tags using managed application definition?

Answer 1

@Chinmay Vartak - Welcome to Microsoft Q&A and thanks for reaching out.

For security or compliance, your subscription administrators might assign policies that limit how resources are deployed. For example, policies that prevent creating public IP addresses, network security groups, user-defined routes, or route tables.

To resolve RequestDisallowedByPolicy errors, review the resource policies and determine how to deploy resources that comply with those policies. The error message displays the names of the policy definition and policy assignment.

Please take a look at this document for more info : error-policy-requestdisallowedbypolicy

UPDATE:

So I have confirmed with Product team and was told that there is no way to set the tag on a managed resource group today, so this would fail. You would have to add a policy exception to exempt the Managed app and its resource group from this policy.

Hope this helps. and please feel free to reach out if you have any further questions.

------------------------------------------------------------------

If the above response was helpful, please feel free to "Accept as Answer" and "Upvote" the same so it can be beneficial to the community.