change cross scope deployments

Author: tfitzmac

.openpublishing.redirection.json

@@ -5078,6 +5078,11 @@
       "redirect_url": "/azure/azure-resource-manager/templates/template-syntax",
       "redirect_document_id": false
     },
+    {
+      "source_path": "articles/azure-resource-manager/templates/cross-resource-group-deployment.md",
+      "redirect_url": "/azure/azure-resource-manager/templates/cross-scope-deployment",
+      "redirect_document_id": false
+    },
     {
       "source_path": "articles/azure-resource-manager/templates/use-vs-code-to-create-template.md",
       "redirect_url": "/azure/azure-resource-manager/templates/quickstart-create-templates-use-visual-studio-code",

articles/automation/automation-enable-changes-from-browse.md

@@ -10,7 +10,7 @@ ms.custom: mvc
 
 This article describes how you can enable the [Change Tracking and Inventory](change-tracking.md) feature for VMs by browsing the Azure portal. To enable Azure VMs at scale, you must enable an existing VM using Change Tracking and Inventory. 
 
-The number of resource groups that you can use for managing your VMs is limited by the [Resource Manager deployment limits](../azure-resource-manager/templates/cross-resource-group-deployment.md). Resource Manager deployments, not to be confused with update deployments, are limited to five resource groups per deployment. Two of these resource groups are reserved to configure the Log Analytics workspace, Automation account, and related resources. This leaves you with three resource groups to select for management by Change Tracking and Inventory. This limit only applies to simultaneous setup, not the number of resource groups that can be managed by an Automation feature.
+The number of resource groups that you can use for managing your VMs is limited by the [Resource Manager deployment limits](../azure-resource-manager/templates/cross-scope-deployment.md). Resource Manager deployments, not to be confused with update deployments, are limited to five resource groups per deployment. Two of these resource groups are reserved to configure the Log Analytics workspace, Automation account, and related resources. This leaves you with three resource groups to select for management by Change Tracking and Inventory. This limit only applies to simultaneous setup, not the number of resource groups that can be managed by an Automation feature.
 
 > [!NOTE]
 > When enabling Change Tracking and Inventory, only certain regions are supported for linking a Log Analytics workspace and an Automation Account. For a list of the supported mapping pairs, see [Region mapping for Automation Account and Log Analytics workspace](how-to/region-mappings.md).

articles/automation/automation-onboard-solutions-from-browse.md

@@ -10,7 +10,7 @@ ms.custom: mvc
 
 This article describes how you can enable the [Update Management](automation-update-management.md) feature for VMs by browsing the Azure portal. To enable Azure VMs at scale, you must enable an existing VM using Update Management. 
 
-The number of resource groups that you can use for managing your VMs is limited by the [Resource Manager deployment limits](../azure-resource-manager/templates/cross-resource-group-deployment.md). Resource Manager deployments, not to be confused with Update deployments, are limited to five resource groups per deployment. Two of these resource groups are reserved to configure the Log Analytics workspace, Automation account, and related resources. This leaves you with three resource groups to select for management by Update Management. This limit only applies to simultaneous setup, not the number of resource groups that can be managed by an Automation feature.
+The number of resource groups that you can use for managing your VMs is limited by the [Resource Manager deployment limits](../azure-resource-manager/templates/cross-scope-deployment.md). Resource Manager deployments, not to be confused with Update deployments, are limited to five resource groups per deployment. Two of these resource groups are reserved to configure the Log Analytics workspace, Automation account, and related resources. This leaves you with three resource groups to select for management by Update Management. This limit only applies to simultaneous setup, not the number of resource groups that can be managed by an Automation feature.
 
 > [!NOTE]
 > When enabling Update Management, only certain regions are supported for linking a Log Analytics workspace and an Automation Account. For a list of the supported mapping pairs, see [Region mapping for Automation Account and Log Analytics workspace](how-to/region-mappings.md).

articles/azure-resource-manager/management/manage-resources-cli.md

@@ -54,7 +54,7 @@ You can create a resource group and deploy resources to the group. For more info
 
 ## Deploy resources to multiple subscriptions or resource groups
 
-Typically, you deploy all the resources in your template to a single resource group. However, there are scenarios where you want to deploy a set of resources together but place them in different resource groups or subscriptions. For more information, see [Deploy Azure resources to multiple subscriptions or resource groups](../templates/cross-resource-group-deployment.md).
+Typically, you deploy all the resources in your template to a single resource group. However, there are scenarios where you want to deploy a set of resources together but place them in different resource groups or subscriptions. For more information, see [Deploy Azure resources to multiple subscriptions or resource groups](../templates/cross-scope-deployment.md).
 
 ## Delete resources
 

articles/azure-resource-manager/management/manage-resources-powershell.md

@@ -57,7 +57,7 @@ You can create a resource group and deploy resources to the group. For more info
 
 ## Deploy resources to multiple subscriptions or resource groups
 
-Typically, you deploy all the resources in your template to a single resource group. However, there are scenarios where you want to deploy a set of resources together but place them in different resource groups or subscriptions. For more information, see [Deploy Azure resources to multiple subscriptions or resource groups](../templates/cross-resource-group-deployment.md).
+Typically, you deploy all the resources in your template to a single resource group. However, there are scenarios where you want to deploy a set of resources together but place them in different resource groups or subscriptions. For more information, see [Deploy Azure resources to multiple subscriptions or resource groups](../templates/cross-scope-deployment.md).
 
 ## Delete resources
 

articles/azure-resource-manager/templates/common-deployment-errors.md

@@ -72,7 +72,7 @@ If you're looking for information about an error code and that information isn't
 | SubnetsNotInSameVnet | A virtual machine can only have one virtual network. When deploying several NICs, make sure they belong to the same virtual network. | [Multiple NICs](../../virtual-machines/windows/multiple-nics.md) |
 | SubscriptionNotRegistered | When deploying network resources, the Microsoft.Network resource provider is automatically registered in the subscription. Sometimes, the automatic registration doesn't complete in time. To avoid this intermittent error, register the Microsoft.Network resource provider before deployment. | [Resolve registration](error-register-resource-provider.md) |
 | TemplateResourceCircularDependency | Remove unnecessary dependencies. | [Resolve circular dependencies](error-invalid-template.md#circular-dependency) |
-| TooManyTargetResourceGroups | Reduce number of resource groups for a single deployment. | [Cross resource group deployment](cross-resource-group-deployment.md) |
+| TooManyTargetResourceGroups | Reduce number of resource groups for a single deployment. | [Cross scope deployment](cross-scope-deployment.md) |
 
 ## Find error code
 

articles/azure-resource-manager/templates/complete-mode-deletion.md

@@ -13,7 +13,7 @@ The resource types marked with **Yes** are deleted when the type isn't in the te
 
 The resource types marked with **No** aren't automatically deleted when not in the template; however, they're deleted if the parent resource is deleted. For a full description of the behavior, see [Azure Resource Manager deployment modes](deployment-modes.md).
 
-If you deploy to [more than one resource group in a template](cross-resource-group-deployment.md), resources in the resource group specified in the deployment operation are eligible to be deleted. Resources in the secondary resource groups aren't deleted.
+If you deploy to [more than one resource group in a template](cross-scope-deployment.md), resources in the resource group specified in the deployment operation are eligible to be deleted. Resources in the secondary resource groups aren't deleted.
 
 Jump to a resource provider namespace:
 > [!div class="op_single_selector"]

…lates/cross-resource-group-deployment.md …ager/templates/cross-scope-deployment.mdarticles/azure-resource-manager/templates/cross-resource-group-deployment.md renamed to articles/azure-resource-manager/templates/cross-scope-deployment.md articles/azure-resource-manager/templates/cross-resource-group-deployment.md renamed to articles/azure-resource-manager/templates/cross-scope-deployment.md

@@ -1,26 +1,32 @@
 ---
-title: Deploy resources cross subscription & resource group
-description: Shows how to target more than one Azure subscription and resource group during deployment.
+title: Deploy resources across scopes
+description: Shows how to target more than one scope during a deployment. The scope can be a tenant, management groups, subscriptions, and resource groups.
 ms.topic: conceptual
-ms.date: 05/18/2020
+ms.date: 07/28/2020
 ---
 
-# Deploy Azure resources across subscriptions or resource groups
+# Deploy Azure resources across scopes
 
-Resource Manager enables you to deploy to more than one resource group in a single deployment. You use nested templates to specify resource groups that are different than the resource group in the deployment operation. The resource groups can exist in different subscriptions.
+With Azure Resource Manager templates (ARM templates), you can deploy to more than one scope in a single deployment. The available scopes are a tenant, management groups, subscriptions, and resource groups. For example, you can deploy resources to one resource group, and in the same template deploy resources to another resource group. Or, you can deploy resources to a management group and also deploy resources to a resource group within that management group.
 
-> [!NOTE]
-> You can deploy to **800 resource groups** in a single deployment. Typically, this limitation means you can deploy to one resource group specified for the parent template, and up to 799 resource groups in nested or linked deployments. However, if your parent template contains only nested or linked templates and does not itself deploy any resources, then you can include up to 800 resource groups in nested or linked deployments.
+You use [nested or linked templates](linked-templates.md) to specify scopes that are different than the primary scope for the deployment operation.
+
+## Available scopes
 
-## Specify subscription and resource group
+The scope that you use for the deployment operation determines which other scopes are available. You can deploy to the [tenant](deploy-to-tenant.md), [management group](deploy-to-management-group.md), [subscription](deploy-to-subscription), or [resource group](deploy-powershell.md). From the primary deployment level, you can't go up levels in the hierarchy. For example, if you deploy to a subscription, you can't step up a level to deploy resources to a management group. However, you can deploy to the management group and step down levels to deploy to a subscription or resource group.
 
-To target a resource group that is different than the one for parent template, use a [nested or linked template](linked-templates.md). Within the deployment resource type, specify values for the subscription ID and resource group that you want the nested template to deploy to.
+For every scope, the user deploying the template must have the required permissions to create resources.
+
+## Cross resource groups
+
+To target a resource group that is different than the one for parent template, use a [nested or linked template](linked-templates.md). Within the deployment resource type, specify values for the subscription ID and resource group that you want the nested template to deploy to. The resource groups can exist in different subscriptions.
 
 :::code language="json" source="~/resourcemanager-templates/azure-resource-manager/crosssubscription.json" range="38-43" highlight="5-6":::
 
 If you don't specify the subscription ID or resource group, the subscription and resource group from the parent template are used. All the resource groups must exist before running the deployment.
 
-The account that deploys the template must have permission to deploy to the specified subscription ID. If the specified subscription exists in a different Azure Active Directory tenant, you must [add guest users from another directory](../../active-directory/b2b/what-is-b2b.md).
+> [!NOTE]
+> You can deploy to **800 resource groups** in a single deployment. Typically, this limitation means you can deploy to one resource group specified for the parent template, and up to 799 resource groups in nested or linked deployments. However, if your parent template contains only nested or linked templates and does not itself deploy any resources, then you can include up to 800 resource groups in nested or linked deployments.
 
 The following example deploys two storage accounts. The first storage account is deployed to the resource group specified in the deployment operation. The second storage account is deployed to the resource group specified in the `secondResourceGroup` and `secondSubscriptionID` parameters:
 
@@ -114,9 +120,17 @@ az deployment group create \
 
 ---
 
-## Use functions
+## Cross subscription, management group, and tenant
+
+When specifying different scopes for subscription, management group and tenant level deployments, you use nested deployments like the example for resource groups. The properties that you use for specifying scope can differ. Those scenarios are covered in the articles about the levels of deployments. For more information, see:
+
+* [Create resource groups and resources at the subscription level](deploy-to-subscription.md)
+* [Create resources at the management group level](deploy-to-management-group.md)
+* [Create resources at the tenant level](deploy-to-tenant.md)
 
-The [resourceGroup()](template-functions-resource.md#resourcegroup) and [subscription()](template-functions-resource.md#subscription) functions resolve differently based on how you specify the template. When you link to an external template, the functions always resolve to the scope for that template. When you nest a template within a parent template, use the `expressionEvaluationOptions` property to specify whether the functions resolve to the resource group and subscription for the parent template or the nested template. Set the property to `inner` to resolve to the scope for the nested template. Set the property to `outer` to resolve to the scope of the parent template.
+## How functions resolve in scopes
+
+When you deploy to more than one scope, the [resourceGroup()](template-functions-resource.md#resourcegroup) and [subscription()](template-functions-resource.md#subscription) functions resolve differently based on how you specify the template. When you link to an external template, the functions always resolve to the scope for that template. When you nest a template within a parent template, use the `expressionEvaluationOptions` property to specify whether the functions resolve to the resource group and subscription for the parent template or the nested template. Set the property to `inner` to resolve to the scope for the nested template. Set the property to `outer` to resolve to the scope of the parent template.
 
 The following table shows whether the functions resolve to the parent or embedded resource group and subscription.
 
@@ -197,6 +211,8 @@ The output from the preceding example is:
 
 ---
 
+
+
 ## Next steps
 
 * To understand how to define parameters in your template, see [Understand the structure and syntax of Azure Resource Manager templates](template-syntax.md).

articles/azure-resource-manager/templates/deployment-modes.md

@@ -23,7 +23,7 @@ If your template includes a resource that isn't deployed because [condition](con
 
 Be careful using complete mode with [copy loops](copy-resources.md). Any resources that aren't specified in the template after resolving the copy loop are deleted.
 
-If you deploy to [more than one resource group in a template](cross-resource-group-deployment.md), resources in the resource group specified in the deployment operation are eligible to be deleted. Resources in the secondary resource groups aren't deleted.
+If you deploy to [more than one resource group in a template](cross-scope-deployment.md), resources in the resource group specified in the deployment operation are eligible to be deleted. Resources in the secondary resource groups aren't deleted.
 
 There are some differences in how resource types handle complete mode deletions. Parent resources are automatically deleted when not in a template that's deployed in complete mode. Some child resources aren't automatically deleted when not in the template. However, these child resources are deleted if the parent resource is deleted.
 

articles/azure-resource-manager/templates/error-invalid-template.md

@@ -124,7 +124,7 @@ Double check the allowed values in the template, and provide one during deployme
 
 ## Solution 4 - Too many target resource groups
 
-You may see this error in earlier deployments because you were limited to five target resource groups in a single deployment. In May 2020, that limit was increased to 800 resource groups. For more information, see [Deploy Azure resources to more than one subscription or resource group](cross-resource-group-deployment.md).
+You may see this error in earlier deployments because you were limited to five target resource groups in a single deployment. In May 2020, that limit was increased to 800 resource groups. For more information, see [Deploy Azure resources to more than one subscription or resource group](cross-scope-deployment.md).
 
 <a id="circular-dependency"></a>