title: How to deploy ARM template with user managed identity and assign a subscription level role?
body: <p>The ARM template below is supposed to create the following resources:</p>
  <pre><code>resource group
      - user managed identity
         - subscription level Contributor role assignment
  </code></pre>
  <p>Currently the deployment is failing with the error <code>&quot;error&quot;: { &quot;code&quot;: &quot;ResourceGroupNotFound&quot;, &quot;message&quot;: &quot;Resource group 'rg-myproject-deploy' could not be found.&quot; }</code> apparently because the role assignment step seem to not be respecting the <code>dependsOn</code> statements that should enforce that it should only happen after the resource group is created. Is there a way to deploy all these resources in a single ARM template?</p>
  <p><a href="https://i.stack.imgur.com/graIn.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/graIn.png" alt="deployment error" /></a></p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;$schema&quot;: &quot;https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#&quot;,
    &quot;contentVersion&quot;: &quot;1.0.0.0&quot;,
    &quot;parameters&quot;: {
      &quot;projectName&quot;: {
        &quot;type&quot;: &quot;string&quot;,
        &quot;defaultValue&quot;: &quot;myproject&quot;,
        &quot;maxLength&quot;: 11,
        &quot;metadata&quot;: {
          &quot;description&quot;: &quot;The name of the project&quot;
        }
      },
      &quot;location&quot;: {
        &quot;type&quot;: &quot;string&quot;,
        &quot;defaultValue&quot;: &quot;westus2&quot;,
        &quot;metadata&quot;: {
          &quot;description&quot;: &quot;The region were to deploy assets&quot;
        }
      }
    },
    &quot;variables&quot;: {
      &quot;resourceGroupName&quot;: &quot;[concat('rg-', parameters('projectName'), '-deploy')]&quot;,
      &quot;managedIdentityName&quot;: &quot;[concat('msi-', parameters('projectName'), '-deploy')]&quot;,
      &quot;bootstrapRoleAssignmentId&quot;: &quot;[guid(subscription().id, 'contributor')]&quot;,
      &quot;contributorRoleDefinitionId&quot;: &quot;[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]&quot;,
      &quot;managedIdentityId&quot;: &quot;[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', variables('resourceGroupName'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', variables('managedIdentityName'))]&quot;
    },
    &quot;resources&quot;: [
      {
        &quot;type&quot;: &quot;Microsoft.Resources/resourceGroups&quot;,
        &quot;apiVersion&quot;: &quot;2019-10-01&quot;,
        &quot;name&quot;: &quot;[variables('resourceGroupName')]&quot;,
        &quot;location&quot;: &quot;[parameters('location')]&quot;,
        &quot;properties&quot;: {}
      },
      {
        &quot;type&quot;: &quot;Microsoft.Resources/deployments&quot;,
        &quot;apiVersion&quot;: &quot;2019-10-01&quot;,
        &quot;name&quot;: &quot;deployment-assets-except-role-assignment&quot;,
        &quot;resourceGroup&quot;: &quot;[variables('resourceGroupName')]&quot;,
        &quot;dependsOn&quot;: [
          &quot;[resourceId('Microsoft.Resources/resourceGroups/', variables('resourceGroupName'))]&quot;
        ],
        &quot;properties&quot;: {
          &quot;mode&quot;: &quot;Incremental&quot;,
          &quot;template&quot;: {
            &quot;$schema&quot;: &quot;https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#&quot;,
            &quot;contentVersion&quot;: &quot;1.0.0.0&quot;,
            &quot;parameters&quot;: {},
            &quot;variables&quot;: {},
            &quot;resources&quot;: [
              {
                &quot;type&quot;: &quot;Microsoft.ManagedIdentity/userAssignedIdentities&quot;,
                &quot;name&quot;: &quot;[variables('managedIdentityName')]&quot;,
                &quot;apiVersion&quot;: &quot;2018-11-30&quot;,
                &quot;location&quot;: &quot;[parameters('location')]&quot;
              }
            ],
            &quot;outputs&quot;: {}
          }
        }
      }
      ,
      {
        &quot;type&quot;: &quot;Microsoft.Authorization/roleAssignments&quot;,
        &quot;apiVersion&quot;: &quot;2017-09-01&quot;,
        &quot;name&quot;: &quot;[variables('bootstrapRoleAssignmentId')]&quot;,
        &quot;dependsOn&quot;: [
          &quot;[subscriptionResourceId('Microsoft.Resources/resourceGroups', variables('resourceGroupName'))]&quot;,
          &quot;deployment-assets-except-role-assignment&quot;
        ],
        &quot;properties&quot;: {
          &quot;roleDefinitionId&quot;: &quot;[variables('contributorRoleDefinitionId')]&quot;,
          &quot;principalId&quot;: &quot;[reference(variables('managedIdentityId'), '2018-11-30').principalId]&quot;,
          &quot;principalType&quot;: &quot;ServicePrincipal&quot;,
          &quot;scope&quot;: &quot;[subscription().id]&quot;
        }
      }
    ],
    &quot;outputs&quot;: {}
  }
  </code></pre>