Subscription deployment in ResourceGroup scoped template validation error

[franciscojf]

When you have a subscription Microsoft.Resources/deployments under a ResourceGroup scoped template it generates the following error:

Template validation failed: The template resource 'subDeployment' at line '15' and column '9' is invalid. 'ResourceGroup' property must be specified if 'SubscriptionId' property is specified. Please see https://aka.ms/arm-template/#resources for usage details.arm-template (validation)

{ 
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "identityAssignmentGUID": {
            "type": "string",
            "defaultValue": "[newGuid()]",
            "metadata": {
                "description": "A generated guid for the UAI assignment."
            }
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Resources/deployments",
            "apiVersion": "2021-04-01",
            "name": "subDeployment",
            "location": "[resourceGroup().location]",
            "subscriptionId": "[subscription().subscriptionId]",
            "properties": {
                "mode": "Incremental",
                "template": {
                    "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                    "contentVersion": "1.0.0.0",
                    "resources": [
                        {
                            "type": "Microsoft.Authorization/roleAssignments",
                            "apiVersion": "2022-04-01",
                            "name": "[parameters('identityAssignmentGUID')]",
                            "properties": {
                                "principalId": "[reference(resourceId(resourceGroup().name,'Microsoft.ManagedIdentity/userAssignedIdentities', 'UAIIdentity'), '2023-01-31').principalId]",
                                "principalType": "ServicePrincipal",
                                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]"
                            }
                        }
                    ]
                }
            }
        }
    ]
}

[mhollismcgill]

Thumbs up, this bug is also affecting me and I was about to open an issue for it. Nested subscription-scope deployments like this are perfectly valid, and commonly used, for things like role assignments.

[jteves]

Docs to support why this validation error is a bug when doing a nested subscription-scope deployment on a resource-group level deployment (deploymentTemplate.json): https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-resource-group?tabs=azure-cli#scope-to-subscription.

Can there be an update on this since this hasn't been fixed in a year and considering that the docs state this is how it's supposed to be done?