Skip to content

Set Up Access to the Library (XMT Ambassador)

The library is delivered into your own environment: Terraform modules in a read-only repository in Azure DevOps, Bicep modules in a container registry. This page is for the XMT Ambassador: the person on the consumer side who arranges the one-time setup, manages access for people and pipelines, and is the first contact for questions about the library. Under a managed-service contract the maintaining team (XMMS) delivers the modules to what you set up here. When you are self-managed, the maintaining team is a team of your own organisation and the same setup applies (Operating models).

Once the setup is complete, share Use Managed Templates with your teams. The maintaining team does its part in Onboard a consumer.

Reference setup, your environment may differ

The group names and the permissions below are those of the reference setup. Use the names your organisation prefers, and keep the intent: people get read access through a group, and only the identity of the maintaining team can write.

One-time setup

Do these steps once for your organisation.

Create the repository

  1. In Azure DevOps, use an existing project or create one.
  2. Add a new private repository for the library.
  3. Open the security settings of the repository and disable inheritance.
  4. For all groups and users, set these permissions to Not Set: manage advanced security settings, bypass policies when completing pull requests, bypass policies when pushing, contribute, contribute to pull requests, create branch, create tag, delete or disable repository, and force push.

Create a container registry (Bicep only)

Create an Azure Container Registry in the Premium tier. The Premium tier is needed to allow the platform addresses that publish the Bicep modules. Skip this step when you only use Terraform.

Create the service principal for synchronisation

The service principal lets the maintaining team synchronise the modules into your repository and registry.

  1. Create a service principal in Entra ID.
  2. Give it the Reader role at subscription level (the subscription with the registry, or any subscription when you do not use a registry). This is needed to create a service connection. Give it AcrPush on the registry.
  3. Add the service principal to the Azure DevOps organisation with access level Basic, to the project of the repository, and to the Project Readers group.
  4. In the security settings of the repository, set these permissions to Allow for the service principal: bypass policies when pushing, contribute, contribute to pull requests, create tag, force push and read.
  5. Send the following to the maintaining team: the application (client) ID, the directory (tenant) ID, the subscription ID and name where Reader is assigned, the link to the repository and, optionally, the name of the registry.

The maintaining team then sets up the connection and the synchronisation (Onboard a consumer).

Create the access groups

Two groups give you one place to manage access.

  1. Create a security group in Entra ID for the readers (the reference setup calls it XMT_readers).
  2. Give this group the Reader role on the registry.
  3. In Azure DevOps, add a group rule for the group: access level Basic, the project of the repository, and the Project Readers group.
  4. Create an Azure DevOps group for pipelines (the reference setup calls it XMT_access) and give it Read on the repository.

Verify network access

For Bicep, people and pipeline agents need network access to the registry on port 443.

  • Preferred: route the traffic over ExpressRoute or a VPN.
  • Alternative: allow access from the internet or from specific IP addresses, for example the public address of an office.

Ongoing access management

Grant user access

Add the person to the readers group in Entra ID. Nothing else is needed. The person can then read the repository (Terraform) and pull modules from the registry (Bicep).

Grant pipeline access

Terraform pipelines

  1. Add the build identity of the pipeline to the pipeline access group. Which identity this is depends on the organisation setting Limit job authorization scope to current project for non-release pipelines:

    • setting off: Project Collection Build Service (<organisation>)
    • setting on: <project> Build Service (<organisation>)

    The organisation-level setting takes precedence over the project-level setting. 2. Ask the team to declare the library as a repository resource in the pipeline, and to wrap terraform init (and the other Terraform steps) with the git authentication steps. The IaC Accelerator contains both, and they are shown in Option 2. 3. Switch Protect access to repositories in YAML pipelines off for the project.

Bicep pipelines

Add the service connection that the Bicep deployment job uses to the readers group in Entra ID. The pipeline can then pull the modules from the registry.