Quickstart: Create and publish an Azure Managed Application definition

In Visual Studio Code, open a new PowerShell terminal and sign in to your Azure subscription.

Connect-AzAccount

The command opens your default browser and prompts you to sign in to Azure. For more information, go to Sign in with Azure PowerShell.

New-AzResourceGroup -Name packageStorageGroup -Location westus

$pkgstorageparms = @{
  ResourceGroupName = "packageStorageGroup"
  Name = "<pkgstorageaccountname>"
  Location = "westus"
  SkuName = "Standard_LRS"
  Kind = "StorageV2"
  MinimumTlsVersion = "TLS1_2"
  AllowBlobPublicAccess = $true
  AllowSharedKeyAccess = $false
}

$pkgstorageaccount = New-AzStorageAccount @pkgstorageparms

The $pkgstorageparms variable uses PowerShell splatting to improve readability for the parameter values used in the command to create the new storage account. Splatting is used in other PowerShell commands that use multiple parameter values.

After you create the storage account, add the role assignment Storage Blob Data Contributor to the storage account scope. Assign access to your Microsoft Entra user account. Depending on your access level in Azure, you might need other permissions assigned by your administrator. For more information, see Assign an Azure role for access to blob data.

After you add the role to the storage account, it takes a few minutes to become active in Azure. You can then create the context needed to create the container and upload the file.

$pkgstoragecontext = New-AzStorageContext -StorageAccountName $pkgstorageaccount.StorageAccountName -UseConnectedAccount

New-AzStorageContainer -Name appcontainer -Context $pkgstoragecontext -Permission blob

$blobparms = @{
  File = "app.zip"
  Container = "appcontainer"
  Blob = "app.zip"
  Context = $pkgstoragecontext
}

Set-AzStorageBlobContent @blobparms

In Visual Studio Code, open a new Bash terminal session and sign in to your Azure subscription. If you have Git installed, select Git Bash.

az login

The command opens your default browser and prompts you to sign in to Azure. For more information, go to Sign in with Azure CLI.

az group create --name packageStorageGroup --location westus

az storage account create \
  --name <pkgstorageaccountname> \
  --resource-group packageStorageGroup \
  --location westus \
  --sku Standard_LRS \
  --kind StorageV2 \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access true \
  --allow-shared-key-access false

pkgstgacct=$(az storage account show \
  --resource-group packageStorageGroup \
  --name <pkgstorageaccountname> \
  --query name \
  --output tsv)

The backslash (\) is a line continuation character to improve readability of the command's parameters and is used in many of the Azure CLI commands. The pkgstgacct variable contains the storage account name for use in other commands.

After you create the storage account, add the role assignment Storage Blob Data Contributor to the storage account scope. Assign access to your Microsoft Entra user account. Depending on your access level in Azure, you might need other permissions assigned by your administrator. For more information, see Assign an Azure role for access to blob data.

After you add the role to the storage account, it takes a few minutes to become active in Azure. You can then use the parameter --auth-mode login in the commands to create the container and upload the file.

az storage container create \
  --account-name $pkgstgacct \
  --name appcontainer \
  --auth-mode login \
  --public-access blob

az storage blob upload \
  --account-name $pkgstgacct \
  --container-name appcontainer \
  --auth-mode login \
  --name "app.zip" \
  --file "app.zip"

For more information about storage authentication, see Choose how to authorize access to blob data with Azure CLI.

Create a storage account in a new resource group:

1. Sign in to the Azure portal.

2. Select Create a resource from the portal's Home page.

   

3. Search for storage account and select it from the available options.

4. Select Create on the Storage accounts page.

   

5. On the Basics tab, enter the required information.

   

   • Resource group: Select Create new to create the packageStorageGroup resource group.
   • Storage account name: Enter a unique storage account name. The storage account name must be globally unique across Azure and the length must be 3-24 characters with only lowercase letters and numbers.
   • Region: West US3
   • Performance: Standard
   • Redundancy: Locally-redundant storage (LRS).

6. On the Advanced tab, use the following settings.

   • Select Require secure transfer for REST API operations.
   • Select Allow enabling anonymous access on individual containers.
   • Uncheck the box Enable storage account key access.
   • Verify Minimum TLS version is Version 1.2.

7. Accept the defaults on the other tabs.

8. Select Review + create and then select Create.

9. Select Go to resource to go to the storage account.

After you create the storage account, add the role assignment Storage Blob Data Contributor to the storage account scope. Assign access to your Microsoft Entra user account. Depending on your access level in Azure, you might need other permissions assigned by your administrator. For more information, see Assign an Azure role for access to blob data. After you add the role to the storage account, it takes a few minutes to become active in Azure.

Create a container and upload the app.zip file:

1. Go to Data storage and select Containers.

   

2. Configure the container's properties and select Create.

   

   • Name: appcontainer.
   • Public access level: Select Blob.

3. Select appcontainer.

4. Select Upload and follow the prompts to upload your app.zip file to the container.

   

   You can drag and drop the file to the portal or browse to the file's location on your computer.

5. After the file is uploaded, select app.zip in the container.

6. Copy the app.zip file's URL from the Overview > URL.

   

Make a note of the app.zip file's URL because you need it to create the managed application definition.

This example uses a security group, and your Microsoft Entra account should be a member of the group. To get the group's object ID, replace the placeholder <managedAppDemo> including the angle brackets (<>), with your group's name. You use this variable's value when you deploy the managed application definition.

To create a new Microsoft Entra group, go to Manage Microsoft Entra groups and group membership.

$principalid=(Get-AzADGroup -DisplayName <managedAppDemo>).Id

Next, get the role definition ID of the Azure built-in role you want to grant access to the user, group, or application. You use this variable's value when you deploy the managed application definition.

$roleid=(Get-AzRoleDefinition -Name Owner).Id

This example uses a security group, and your Microsoft Entra account should be a member of the group. To get the group's object ID, replace the placeholder <managedAppDemo> including the angle brackets (<>), with your group's name. You use this variable's value when you deploy the managed application definition.

To create a new Microsoft Entra group, go to Manage Microsoft Entra groups and group membership.

principalid=$(az ad group show --group <managedAppDemo> --query id --output tsv)

Next, get the role definition ID of the Azure built-in role you want to grant access to the user, group, or application. You use this variable's value when you deploy the managed application definition.

roleid=$(az role definition list --name Owner --query [].name --output tsv)

In the portal, the group ID and role ID are configured when you publish the managed application definition.

Create a resource group for your managed application definition.

New-AzResourceGroup -Name appDefinitionGroup -Location westus

The blob command creates a variable to store the URL for the package .zip file. That variable is used in the command that creates the managed application definition.

$blob = Get-AzStorageBlob -Container appcontainer -Blob app.zip -Context $pkgstoragecontext

$publishparms = @{
  Name = "sampleManagedApplication"
  Location = "westus"
  ResourceGroupName = "appDefinitionGroup"
  LockLevel = "ReadOnly"
  DisplayName = "Sample managed application"
  Description = "Sample managed application that deploys web resources"
  Authorization = "${principalid}:$roleid"
  PackageFileUri = $blob.ICloudBlob.StorageUri.PrimaryUri.AbsoluteUri
}

New-AzManagedApplicationDefinition @publishparms

When the command completes, you have a managed application definition in your resource group.

Some of the parameters used in the preceding example are:

• ResourceGroupName: The name of the resource group where the managed application definition is created.
• LockLevel: The lockLevel on the managed resource group prevents the customer from performing undesirable operations on this resource group. Currently, ReadOnly is the only supported lock level. ReadOnly specifies that the customer can only read the resources present in the managed resource group. The publisher identities that are granted access to the managed resource group are exempt from the lock level.
• Authorization: Describes the principal ID and the role definition ID that are used to grant permission to the managed resource group.
  • "${principalid}:$roleid" or you can use curly braces for each variable "${principalid}:${roleid}".
  • Use a comma to separate multiple values: "${principalid1}:$roleid1", "${principalid2}:$roleid2".
• PackageFileUri: The location of a .zip package file that contains the required files.

Create a resource group for your managed application definition.

az group create --name appDefinitionGroup --location westus

The blob command creates a variable to store the URL for the package .zip file. That variable is used in the command that creates the managed application definition.

blob=$(az storage blob url \
  --account-name $pkgstgacct \
  --container-name appcontainer \
  --auth-mode login \
  --name app.zip --output tsv)

az managedapp definition create \
  --name "sampleManagedApplication" \
  --location "westus" \
  --resource-group appDefinitionGroup \
  --lock-level ReadOnly \
  --display-name "Sample managed application" \
  --description "Sample managed application that deploys web resources" \
  --authorizations "$principalid:$roleid" \
  --package-file-uri "$blob"

When the command completes, you have a managed application definition in your resource group.

Some of the parameters used in the preceding example are:

• resource-group: The name of the resource group where the managed application definition is created.
• lock-level: The lockLevel on the managed resource group prevents the customer from performing undesirable operations on this resource group. Currently, ReadOnly is the only supported lock level. ReadOnly specifies that the customer can only read the resources present in the managed resource group. The publisher identities that are granted access to the managed resource group are exempt from the lock level.
• authorizations: Describes the principal ID and the role definition ID that are used to grant permission to the managed resource group.
  • "$principalid:$roleid" or you can use curly braces like "${principalid}:${roleid}".
  • Use a space to separate multiple values: "$principalid1:$roleid1" "$principalid2:$roleid2".
• package-file-uri: The location of a .zip package file that contains the required files.

To publish a managed application definition from the Azure portal, use the following steps.

1. Select Create a resource from the portal's Home page.

2. Search for Service Catalog Managed Application Definition and select it from the available options.

3. Select Create from the Service Catalog Managed Application Definition page.

   

4. On the Basics tab, enter the following information and select Next.

   

   • Project details:
     • Select your subscription name.
     • Create a new resource group named appDefinitionGroup.
   • Instance details:
     • Name: Enter a name like instance-name. The name isn't used in the definition but the form requires an entry.
     • Region: West US3
   • Application details:
     • Name: sampleManagedApplication
     • Display name: Sample managed application
     • Description: Sample managed application that deploys web resources

5. On the Package tab, enter the Package file uri for your app.zip file.

6. Ignore the Management settings tab.

7. On the Authentication and lock level tab, enter the following information and then select Review + create.

   

   • Lock level: Select Read Only.

   • Select Add members.

     • Roles: Select Owner.
     • Select principals: Select your group's name like managedAppDemo.

     The Lock level on the managed resource group prevents the customer from performing undesirable operations on this resource group. Currently, Read Only is the only supported lock level. Read Only specifies that the customer can only read the resources present in the managed resource group. The publisher identities that are granted access to the managed resource group are exempt from the lock level.

8. After Validation Passed is displayed, select Create.

   

When the deployment is complete, you have a managed application definition in your resource group.

The command prompts you to confirm that you want to remove the resource group.

Remove-AzResourceGroup -Name packageStorageGroup

Remove-AzResourceGroup -Name appDefinitionGroup

The command prompts for confirmation, and then returns you to command prompt while resources are being deleted.

az group delete --resource-group packageStorageGroup --no-wait

az group delete --resource-group appDefinitionGroup --no-wait

1. From Azure portal Home, in the search field, enter resource groups.
2. Select Resource groups.
3. Select packageStorageGroup and Delete resource group.
4. To confirm the deletion, enter the resource group name and select Delete.

Use the same steps to delete appDefinitionGroup.