Management Group Query

[RoshE03]

Hi everyone,

Apologies if this is me being dim, but having deployed IPAM into one management group and subscription, how can i give it access to see vnets and subs in other management groups?

[DCMattyG]

Hey there @RoshE03, appreciate you reaching out for assistance here!

Before I answer your question directly, may I ask how you deployed Azure IPAM? Did you use the deployment script? Did you use the single deployment or the two-part (Identities then Infrastructure)?

TL:DR - The permissions for Azure IPAM are based entirely on the Engine identity (App Registration) that gets created. By default, it is assigned Reader at the Root Management Group, that is what gives it visibility across the entire Tenant. If you've manually created this identity and assigned it Reader over a different scope (e.g. a single Management Group), then you can simply assign it a Reader role on another Management Group as well to allow visibility to that one as well.

Hope that helps, but I'm here for anything else you may need!