You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+13-7Lines changed: 13 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -20,9 +20,11 @@ To run this module, you need the following:
20
20
- Permissions on Azure Resource Level: User Access Administrator on the Management Group that should be managed by meshStack
21
21
22
22
### If using an Enterprise Agreement
23
+
23
24
- Permissions on [Enterprise Agreement level](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-ea-roles): Account Owner for the enrollment account that should be used for creating subscriptions
24
25
25
26
### If using a Microsoft Customer Agreement
27
+
26
28
- Permissions in Source Tenant for granting access to the billing account used for subscription creation: Account Administrator
27
29
28
30
## How to Use This Module
@@ -62,20 +64,24 @@ To run this module, you need the following:
62
64
```
63
65
64
66
#### If Using an Enterprise Agreement
67
+
65
68
1. Grant access on the enrollment account as described in the section [Use an Enteprise Enrollment](https://docs.meshcloud.io/docs/meshstack.how-to.integrate-meshplatform-azure-manually.html#use-an-enterprise-enrollment).
66
69
67
70
#### If Using Microsoft Customer Agreement
71
+
>
72
+
> Until <https://github.com/hashicorp/terraform-provider-azurerm/issues/15211> is resolved, MCA service principal setup can only be done manually.
73
+
68
74
1. Switch to the Tenant Directory that contains your Billing Account and follow the steps to [Register an Application](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#register-an-application) and [Add Credentials](https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-credentials). Make sure to copy down the **Directory (tenant) ID**, **Application (client) ID**, **Object ID** and the **App Secret** value that was generated. The App Secret is only visible during the creation process.
69
75
2. You must grant the Enterprise Application permissions on the Billing Account, Billing Profile, or Invoice Section so that it can generate new subscriptions. Follow the steps in [this guide](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/understand-mca-roles#manage-billing-roles-in-the-azure-portal) to grant the necessary permissions. You must grant one of the following permissions
70
-
- Billing Account or Billing Profile: Owner, Contributor
3. Write down the Billing Scope ID that looks something like this <samp>/providers/Microsoft.Billing/billingAccounts/5e98e158-xxxx-xxxx-xxxx-xxxxxxxxxxxx:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx_xxxx-xx-xx/billingProfiles/AW4F-xxxx-xxx-xxx/invoiceSections/SH3V-xxxx-xxx-xxx</samp>
73
79
4. Use the following information to configure the platform in meshStack
74
-
- Billing Scope
75
-
- Destination Tenant ID
76
-
- Source Tenant ID
77
-
- Billing Account Principal Client ID (Application Client ID that will be used to create new subscriptions)
78
-
- Principal Client Secret (Application Secret created in the Source Tenant)
80
+
- Billing Scope
81
+
- Destination Tenant ID
82
+
- Source Tenant ID
83
+
- Billing Account Principal Client ID (Application Client ID that will be used to create new subscriptions)
84
+
- Principal Client Secret (Application Secret created in the Source Tenant)
0 commit comments