Not getting the excludedActions on an Azure Bluerprint to work

Question

Not getting the excludedActions on an Azure Bluerprint to work

Erwin Staal 6 MVP

Hi all,

I'm deploying a Blueprint that contains a Recovery Services Vault. That Blueprint gets the read only lock. Now I want others, who are contributor on the particular resource group, to be able to still add a machine to that Recovery Services Vault. I therefore added the following action to the list of excludedActions on the blueprint: 'Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write' like so:

    "locks": { 
      "mode": "AllResourcesReadOnly", 
      "excludedActions": [ 
        "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write" 
      ] 
    }

I however still get the error message saying that the deny assignment is blocking me from doing that. Nor do I see the above action in the deny assignment on the resource group as an exclusion.

Redacted error:

The client ‘<me>’ with object id '' has permission to perform action 'Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/write' on scope '/subscriptions/<sub>/resourcegroups/<group>/providers/Microsoft.RecoveryServices/vaults/<VaultName>/backupFabrics/Azure/protectionContainers/<item>/protectedItems/<item>’; however, the access is denied because of the deny assignment with name 'Deny assignment ‘<assignmentId>’ created by Blueprint Assignment '/providers/Microsoft.Management/managementGroups/<group>/providers/Microsoft.Blueprint/blueprintAssignments/<sub>-LockedBlueprintAssignment'.' and Id ‘<assignmentId>’ at scope '/subscriptions/<subId>/resourceGroups/<group>/providers/Microsoft.RecoveryServices/vaults/<vaultName>’.

SwathiDhanwada-MSFT 19,093 Reputation points Moderator

2021-03-25T16:07:13.08+00:00

@Erwin Staal Welcome to Microsoft Q & A Community Forum. Are you still being prompted with the issue ? Also, can you please let me know if you have waited for 30 min to test if the lock is working or not ? Sometimes, due to cache you may have been prompted with an error. Kindly check and revert if you have further questions.
SwathiDhanwada-MSFT 19,093 Reputation points Moderator

2021-03-30T08:13:23.077+00:00

@Erwin Staal Did you get chance to check my previous comment ? Kindly revert if you are still facing the issue.

1 answer

Your answer

SwathiDhanwada-MSFT 19,093 Reputation points Moderator

2021-03-25T16:07:13.08+00:00

@Erwin Staal Welcome to Microsoft Q & A Community Forum. Are you still being prompted with the issue ? Also, can you please let me know if you have waited for 30 min to test if the lock is working or not ? Sometimes, due to cache you may have been prompted with an error. Kindly check and revert if you have further questions.
SwathiDhanwada-MSFT 19,093 Reputation points Moderator

2021-03-30T08:13:23.077+00:00

@Erwin Staal Did you get chance to check my previous comment ? Kindly revert if you are still facing the issue.

Answer 1

For blueprint resource locks, the carve-outs go in the assignment's locks object via

excludedPrincipals (and, where supported, excludedActions). A read-only lock blocks write

actions for everyone except the excluded principals, so to let contributors add a VM/item to a

Recovery Services Vault you generally need to exclude those principals on the lock - excludedActions

alone often won't grant the management-plane calls. See the resource-locking concept docs for the

exact lock schema. Forward-looking: Deployment Stacks "deny settings" provide the same capability

via denySettingsExcludedPrincipals / denySettingsExcludedActions.

Heads-up: Azure Blueprints (Preview) is being retired on January 31, 2027, with a phased

retirement beginning July 31, 2026 (no new definitions/versions after Jul 31, 2026; no

definition edits or new assignments after Oct 31, 2026; no assignment edits after Dec 31, 2026).

Resources already deployed remain, but blueprint definitions, assignments, and locks (deny

assignments) are removed at retirement - export anything you want to keep first.

Recommended path: migrate to Azure Deployment Stacks (resource grouping, lifecycle management,

and deny-assignment locking) plus Template Specs for versioned storage.

• Retirement & timeline: https://aka.ms/AzureBlueprintsRetirement

• Migration guide: https://aka.ms/AzureBlueprintsMigration

• FAQ: https://aka.ms/AzureBlueprintsRetirementFAQ