Assign roles Owner and Contributor to Azure AD groups at the tenant level

tenant-roles.bicep

targetScope = 'tenant'

// Groups defined in Azure AD
var AzureAdmininstrators = '<ourprivateguidfortheADgroup>'
var AzureSubscriptionOwners = '<ourprivateguidfortheADgroup>'

// Azure built-in role IDs (see: https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles)
var OwnerRoleDefinitionId = '8e3af657-a8ff-443c-a75c-2fe8c4bcb635'
var ContributorRoleDefinitionId = 'b24988ac-6180-42a0-ab88-20f7382dd24c'


// Generate uniqe names for the assignent and role
var OwnerRoleAssignmentName = guid(AzureSubscriptionOwners, OwnerRoleDefinitionId)
var ContributorRoleAssignmentName = guid(AzureAdmininstrators, ContributorRoleDefinitionId)


resource assignOwnerRole 'Microsoft.Authorization/roleAssignments@2020-08-01-preview' = {
  name: OwnerRoleAssignmentName
  properties: {
    roleDefinitionId: OwnerRoleDefinitionId
    principalId: AzureSubscriptionOwners
  }
}

resource assignContributorRole 'Microsoft.Authorization/roleAssignments@2020-08-01-preview' = {
  name: ContributorRoleAssignmentName
  properties: {
    roleDefinitionId: ContributorRoleDefinitionId
    principalId: AzureAdmininstrators
  }
}


// To deploy this, use the following AZ CLI command (adapted to your needs of course)
// 
// az deployment tenant create --template-file .\tenant-roles.bicep -l westeurope