About every half year I need to create the famous “Deploy to Azure” button… so here is a quick’n’dirty Powershell script which creates the link and the proper markdown. There is also support to include the UI definition/wizard file.

Intro and use cases

For a project I needed to create AAD groups while only having a single Bicep/ARM deployment (including UI Wizard)… I decided to go with deployment scripts (Powershell) and a user-assigned Managed Identity. This approach can also be used for Azure Market Place offers.

Deployment scripts in ARM/Bicep enable custom automation for your environment management. You use deployment scripts to execute your own scripts within your ARM template deployments.

Possible use cases (not complete):

• create resources which can’t be described using Bicep, e.g.:
  • AAD users / groups
  • External identities settings like catalogs and access packages
  • Identity governance settings like connected organizations
• consume external APIs

Outputs from deployment scripts can be “returned” (e.g created AAD group identifiers).

The Azure Active Directory module is not supported in newer Powershell versions (7+) and will be retired at any time after June 30, 2023. I used a script by maayanlux from the Azure Cloud AI Blog to assign Graph Application Permissions in the past, but couldn’t get it working with newer Powershell Versions.

The new way is to use the Graph Module (/API). I found a script from Jannik Reinhard but it doesn’t support multiple permissions. Let’s combine them… I also added a verify step which shows current assigned permissions and when they were assigned…

I recently came across some special chars in Sentinel Entitites which broke my KQL Query. I decided to create a whitelist solution to sanitize strings.

Sentinel Playground is a project that aims to speed up deployment and configuration tasks of a Sentinel Lab/Demo environment, including sample content and Bicep Templates. This project seeks to use Bicep only.