Spoke Common Settings (common.tf)

Settings that are the same for every spoke are defined once, not in each spoke file. The spoke JSON then only holds what is specific to one workload. This page lists those common settings, what they do, and where they live.

Where the common settings live

In the separate spoke canvas deployment (own repository and pipeline), the common settings are a Terraform file named common.tf with a locals block. In the current platform layout, the part that concerns tenant and shared services is part of mcp.json under SpokeCommon (mcp.json). The names of the settings are the same. Check in the code version you pin which of the settings below your layout reads, and where. The spoke canvas upgrade guides show the older common.tf form.

Overview

Block	Purpose	Required
tenantinfo	Tenant, administrative unit, group name prefix and secret rotation	yes
networking	Hub subscription and the IPAM pools that spokes may allocate from	yes (ipam_pools is optional)
regioninfo	Per region: names, DNS server, virtual hub, central Log Analytics workspace	yes
pim_configurations	Named PIM profiles that PIMGroupConfig refers to	yes, from spoke canvas 2.10
override_defaults.pim_assignments	Per-role overrides of the built-in RBAC role map	no
ghinfo	GitHub organization, base URL and OIDC issuer for the GitHub extension	only with the GitHub extension

tenantinfo

Setting	Description
TenantId	ID of the tenant in which groups are created. Must be the tenant that holds the spoke subscriptions.
AdministrativeUnitId	Object ID of the administrative unit that holds the spoke groups (Prepare identity).
GroupnamePrefix	Prefix of every group the deployment creates, for example SG_SPOKE_.
SPNSecretrotationPeriod	Validity of the secret of each spoke service principal, in days.
NewSubscriptionDefaultManagementGroupId	Default management group for new subscriptions. Present in the example file; check how your version uses it.

Changing the rotation period

Changing SPNSecretrotationPeriod forces new secrets for all service principals that the spoke deployment controls, on the next run. Plan it as a change with a maintenance window, and make sure that consumers of the secrets (for example service connections) pick up the new value (Change spoke).

networking

Setting	Description
virtualhubsubscriptionid	ID of the subscription that holds the virtual hubs that spoke networks connect to.
ipam_pools	Optional map of Azure Virtual Network Manager IPAM pools that spokes may allocate address space from. Key: the name a spoke file uses in ipamPool. Value: the full resource ID of the pool.

The resource IDs of the pools are reported by the platform foundation deployment as the output network_manager_ipam_environment_pool_ids (see Feature flags for deploy_network_manager).

• IPAM pools are regional. Include the region in the key when more than one region has a pool, for example dev-weu.
• Only pools in this map can be used. A spoke that names an unknown pool fails the plan, and the error lists the names that are available.
• Leaving the map out keeps every spoke on hardcoded address prefixes. That stays fully supported.

How a spoke uses a pool: Spoke JSON reference.

regioninfo

One entry per region. The key of the entry is the short region name that spoke files use (targetRegions, network[].region). It is not a property. Keys must be unique.

Setting	Description
azregionname	Azure name of the region, for example westeurope.
regionfriendlyname	Display name, for example West Europe.
dnsserver	IP address of the DNS server for spoke networks in the region. Normally the internal address of the hub firewall in that region (the DNS proxy). A spoke can override it with dnsServerOverwrite.
virtualhub_resourceid	Full resource ID of the virtual hub in the region that spoke networks connect to.
centrallaw_resourceid	Full resource ID of the central Log Analytics workspace that spoke resources log to, for example the activity log forwarding.

pim_configurations

A map of named PIM profiles. Each profile sets an assignment type (active or eligible). For eligible profiles it also sets the activation policy and, if needed, approvers. A spoke refers to a profile by name, so the full policy is not repeated in every spoke file. The notifications setting is accepted but not used at the moment.

The default profiles are nopim, self-approve and approval. Their definition is in the upgrade guide. Details of how profiles and roles fit together: RBAC and PIM for spokes.

override_defaults.pim_assignments

Optional. Changes the built-in RBAC role map for all spokes. See RBAC and PIM for spokes.

ghinfo

Only needed when spokes use the GitHub extension. The values are the default for every spoke; a spoke can override organization and oidc_issuer.

Setting	Description
OrganizationName	GitHub organization in which repositories are created.
OidcIssuer	OIDC issuer URL that the federated credentials trust.
BaseUrl	Base URL of the GitHub instance.

Instance	OidcIssuer	BaseUrl
GitHub.com	https://token.actions.githubusercontent.com	https://github.com/
GitHub Enterprise Server	https://<github host>/_services/token	https://<github host>/

Prepare the GitHub side first: Prepare spoke integrations.

Example

A shortened example with placeholders. A real file has an entry per region.

locals {
  tenantinfo = {
    TenantId                = "<tenant-id>"
    AdministrativeUnitId    = "<administrative-unit-object-id>"
    GroupnamePrefix         = "SG_SPOKE_"
    SPNSecretrotationPeriod = 90
  }

  networking = {
    virtualhubsubscriptionid = "<hub-subscription-id>"

    ipam_pools = {
      dev-weu = "<resource id of the IPAM pool for dev in West Europe>"
      prd-weu = "<resource id of the IPAM pool for prd in West Europe>"
    }
  }

  regioninfo = {
    weu = {
      azregionname          = "westeurope"
      regionfriendlyname    = "West Europe"
      dnsserver             = "<firewall private IP in the region>"
      virtualhub_resourceid = "<resource id of the virtual hub>"
      centrallaw_resourceid = "<resource id of the central Log Analytics workspace>"
    }
  }

  # pim_configurations: see the upgrade guide
  # override_defaults, ghinfo: only when you need them
}

Related pages

• Spoke config and the Spoke JSON reference
• RBAC and PIM for spokes
• Deploy the spoke canvas