With Azure Resource Manager templates (ARM templates), you can deploy to resource groups, subscriptions, management groups, or tenants. Generally, ARM template functions work the same for all scopes. This article describes the differences that exist for some functions depending on the scope.
Supported functions
When deploying to different scopes, there are some important considerations:
The resourceGroup() function is supported for resource group deployments.
The subscription() function is supported for resource group and subscription deployments.
Use the extensionResourceId() function for resources that are implemented as extensions of the management group. Custom policy definitions that are deployed to the management group are extensions of the management group.
To get the resource ID for a custom policy definition at the management group level, use:
Use the tenantResourceId() function to get the ID for a resource deployed at the tenant. Built-in policy definitions are tenant level resources. When assigning a built-in policy at the management group level, use the tenantResourceId function.
To get the resource ID for a built-in policy definition, use:
When you deploy to more than one scope, the resourceGroup() and subscription() functions resolve differently based on how you specify the template. When you link to an external template, the functions always resolve to the scope for that template. When you nest a template within a parent template, use the expressionEvaluationOptions property to specify whether the functions resolve to the resource group and subscription for the parent template or the nested template. Set the property to inner to resolve to the scope for the nested template. Set the property to outer to resolve to the scope of the parent template.
The following table shows whether the functions resolve to the parent or embedded resource group and subscription.
Name Type Value
=============== ========================= ==========
parentRG String Parent resource group is parentGroup
defaultScopeRG String Default scope resource group is parentGroup
innerScopeRG String Inner scope resource group is inlineGroup
linkedRG String Linked resource group is linkedgroup
Azure CLI
az group create --name parentGroup --location southcentralus
az group create --name inlineGroup --location southcentralus
az group create --name linkedGroup --location southcentralus
az deployment group create \
--name ExampleDeployment \
--resource-group parentGroup \
--template-uri https://raw.githubusercontent.com/Azure/azure-docs-json-samples/master/azure-resource-manager/crossresourcegroupproperties.json
The output from the preceding example is:
Output
"outputs": {
"defaultScopeRG": {
"type": "String",
"value": "Default scope resource group is parentGroup"
},
"innerScopeRG": {
"type": "String",
"value": "Inner scope resource group is inlineGroup"
},
"linkedRG": {
"type": "String",
"value": "Linked resource group is linkedGroup"
},
"parentRG": {
"type": "String",
"value": "Parent resource group is parentGroup"
}
},
Build end-to-end solutions in Microsoft Azure to create Azure Functions, implement and manage web apps, develop solutions utilizing Azure storage, and more.