Blurpint Assign at management group vai REST API

Question

Blurpint Assign at management group vai REST API

Mukesh Bhakar 36

I am trying to blueprint scope using REST API to prevent removing lock from owners but it always give below error. I juts kept one resource group and trying to put lock from here.

error

"error": {
"code": "InvalidAssignment",
"message": "This assignment is invalid. Error: 'Blueprint resource group placeholder 'RGBackup' does not exist in blueprint '/providers/Microsoft.Management/managementGroups/blueprintMG/providers/Microsoft.Blueprint/blueprints/sampleblueprint/versions/V3'.'"
}

I am trying to put a lock on the recovery service vault level using the below things.

https://learn.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking

Sadiqh Ahmed 49,666 Reputation points Microsoft External Staff Moderator

2021-08-03T06:10:32.453+00:00

@Mukesh Bhakar Thank you for your post and I apologize for the delayed response!

Can you share the code that reproduce the error? As well as how you are making the REST API call.

1 answer

Your answer

Sadiqh Ahmed 49,666 Reputation points Microsoft External Staff Moderator

2021-08-03T06:10:32.453+00:00

@Mukesh Bhakar Thank you for your post and I apologize for the delayed response!

Can you share the code that reproduce the error? As well as how you are making the REST API call.

Answer 1

When you assign a blueprint at a management group, the assignment object lives at the MG, but the

artifacts (including the lock) still deploy to a subscription. So you must use the

Assignments - Create Or Update REST API and include properties.scope in the request body set to

the target subscription ID. If properties.scope is missing on an MG-scoped assignment, the call

fails - that's the usual cause of the error you're seeing. Also confirm the assignment's managed

identity has Owner on that target subscription so it can create the deny-assignment (lock).

Heads-up: Azure Blueprints (Preview) is being retired on January 31, 2027, with a phased

retirement beginning July 31, 2026 (no new definitions/versions after Jul 31, 2026; no

definition edits or new assignments after Oct 31, 2026; no assignment edits after Dec 31, 2026).

Resources already deployed remain, but blueprint definitions, assignments, and locks (deny

assignments) are removed at retirement - export anything you want to keep first.

Recommended path: migrate to Azure Deployment Stacks (resource grouping, lifecycle management,

and deny-assignment locking) plus Template Specs for versioned storage.

• Retirement & timeline: https://aka.ms/AzureBlueprintsRetirement

• Migration guide: https://aka.ms/AzureBlueprintsMigration

• FAQ: https://aka.ms/AzureBlueprintsRetirementFAQ