Management Group Diagnostic Settings

main.bicep

targetScope = 'managementGroup'

param name string
param displayName string = name
param parentName string = ''
param workspaceResourceId string = ''

resource managementGroup 'Microsoft.Management/managementGroups@2021-04-01' = {
  name: name
  scope: tenant()
  properties: {
    displayName: displayName
    details: empty(parentName) ? {} : {
      parent: {
        id: '/providers/Microsoft.Management/managementGroups/${parentName}'
      }
    }
  }
}

module diag 'mg-diagsettings.bicep' = if(!empty(workspaceResourceId)) {
  scope: managementGroup
  name: '${name}-diag'
  params: {
    profileName: 'log-analytics'
    workspaceResourceId: workspaceResourceId
  }
}

output id string = managementGroup.id

mg-diagsettings.bicep

targetScope = 'managementGroup'

param workspaceResourceId string
param profileName string

resource diag 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: profileName
  properties: {
    workspaceId: workspaceResourceId
    logs: [
      {
        category: 'Administrative'
        enabled: true
      }
      {
        category: 'Policy'
        enabled: true
      }
    ]
  }
}

output id string = diag.id