Possible unnecessary permission assignments for Policy

[MikaelJcSoderberg]

As part of this commit, it was added a additional Management Group, "landingZones" for a secondary permission assignment.

301891f

There has been some addition to the ChangeTracking and monitor policies as well, in these followup issues:
#815
#943
#946

I agree that these seven policies that are assigned at landingZones Management Group also needs assignment on the Platform Management Group Scope, to be able to interact with the UAMI and DCR resources:
Deploy-vmArc-ChangeTrack
Deploy-VMSS-ChangeTrack
Deploy-VMSS-ChangeTrack
Deploy-vmHybr-Monitoring
Deploy-VM-Monitor-24
Deploy-VMSS-Monitor-24
Deploy-MDFC-DefSQL-AMA

What I dont agree with is that these seven policies that are assigned at Platform Management Group also assigns permissions at the landingZones Management Group scope:
Deploy-vmArc-ChangeTrack
Deploy-VMSS-ChangeTrack
Deploy-VMSS-ChangeTrack
Deploy-vmHybr-Monitoring
Deploy-VM-Monitor-24
Deploy-VMSS-Monitor-24
Deploy-MDFC-DefSQL-AMA

I just dont see why a policy that is asssigned at Platform would need permissions in the landingZones Management Group.

[oZakari]

Hi @MikaelJcSoderberg, agreed—I’ll include this change in the upcoming PR for the policy refresh. I may have overthought that one a bit! 😄

[MikaelJcSoderberg]

Do you know the reasoning behind having duplicate assignments(Platform and Landingzones).
I would assign at intermediate root and remove the problem from the start.
I assume the reason would be least privilege, I also assume you inhereted the assignment scope from Enterprise-Scale so there is not much to do.

[oZakari]

Hey @MikaelJcSoderberg, I believe principle of least privilege is the reasoning, but @arjenhuitema can confirm as he was one of the architects for the overall design.