title: How to deploy a managed application with an identity having permissions within the managed resource group?
body: <p>When deploying a marketplace managed app offer into a customer subscription, you can create an identity in the managed resource group associated with the managed application.  However, in order for that identity to have any permissions, it must be assigned a role.</p>
  
  <p>When the publisher and customer are in the same tenant, the roleAssignment can be created as expected and the identity has permissions within the managed resource group.  </p>
  
  <p>However, when the customer is in a different tenant (and active directory), then I get the following error: </p>
  
  <blockquote>
    <p>Principal not found in tenant '[PUBLISHER TENANT ID]'. If you are attempting to PUT this role assignment in tenant '[CUSTOMER TENANT ID]' then the delegatedManagedIdentityResourceId property must be specified</p>
  </blockquote>
  
  <p>Looking into the mentioned <code>delegatedManagedIdentityResourceId</code>, it gets pretty hairy pretty quickly and I'm not sure that's the path I want to go down or if it would even get me where I need to be, which is to have an identity in the managed resource group which has permissions to do read/write operations within the managed resource group.</p>
  
  <p>Thank you.  </p>