title: ARM Template - Set dependency on RBAC Role existing
body: <p>I am able to grant my SQL Server Identity membership of the Storage Blob Contributor role on my storage account using an ARM template.</p>
  <p>However, when creating my Audit resource (which has dependsOn references to both the Storage Account and to the SQL Server) it looks like it is trying to create this before the RBAC permission has been granted as I get</p>
  <pre><code>{
      &quot;status&quot;: &quot;Failed&quot;,
      &quot;error&quot;: {
          &quot;code&quot;: &quot;ResourceDeploymentFailure&quot;,
          &quot;message&quot;: &quot;The resource operation completed with terminal provisioning state 'Failed'.&quot;,
          &quot;details&quot;: [
              {
                  &quot;code&quot;: &quot;BlobAuditingInsufficientStorageAccountPermissions&quot;,
                  &quot;message&quot;: &quot;Insufficient read or write permissions on storage account 'myStorage'. Add permissions to the server Identity to the storage account.&quot;
              }
          ]
      }
  }
  </code></pre>
  <p>Oddly, I have this for Vulnerability Scans from the same server to another Storage Account and this succeeded. I don't know if that was simply a quirk of the way that Azure decided to order the deployment.</p>
  <p>Anyway, is there a way to add a dependsOn reference to the RBAC permission so that I don't try to create the Audit destination to Storage until it has permissions?</p>
  <p>To be clear, the RBAC assignment is a sub-resource of the Storage Account:</p>
  <pre><code>{
              &quot;type&quot;: &quot;Microsoft.Storage/storageAccounts&quot;,
              &quot;apiVersion&quot;: &quot;2019-06-01&quot;,
              &quot;name&quot;: &quot;[variables('auditStorageAccount')]&quot;,
              &quot;location&quot;: &quot;[resourceGroup().location]&quot;,
              &quot;dependsOn&quot;: [
                  &quot;[variables('uniqueSQLName')]&quot;
              ],
              &quot;sku&quot;: {
                  &quot;name&quot;: &quot;Standard_LRS&quot;,
                  &quot;tier&quot;: &quot;Standard&quot;
              },
              &quot;kind&quot;: &quot;StorageV2&quot;,
              &quot;properties&quot;: {
                  &quot;isHnsEnabled&quot;: false,
                  &quot;networkAcls&quot;: {
                      &quot;bypass&quot;: &quot;AzureServices&quot;,
                      &quot;virtualNetworkRules&quot;: [],
                      &quot;ipRules&quot;: [],
                      &quot;defaultAction&quot;: &quot;Deny&quot;
                  },
                  &quot;supportsHttpsTrafficOnly&quot;: true,
                  &quot;encryption&quot;: {
                      &quot;services&quot;: {
                          &quot;file&quot;: {
                              &quot;keyType&quot;: &quot;Account&quot;,
                              &quot;enabled&quot;: true
                          },
                          &quot;blob&quot;: {
                              &quot;keyType&quot;: &quot;Account&quot;,
                              &quot;enabled&quot;: true
                          }
                      },
                      &quot;keySource&quot;: &quot;Microsoft.Storage&quot;
                  },
                  &quot;accessTier&quot;: &quot;Hot&quot;
              },
              &quot;resources&quot;: [
                  {
                      &quot;type&quot;: &quot;Microsoft.Storage/storageAccounts/providers/roleAssignments&quot;,
                      &quot;apiVersion&quot;:  &quot;2020-03-01-preview&quot;,
                      &quot;name&quot;: &quot;[concat(variables('auditStorageAccount'), '/Microsoft.Authorization/', guid(uniqueString(variables('auditStorageAccount'))))]&quot;,
                      &quot;dependsOn&quot;: [
                          &quot;[resourceId('Microsoft.Storage/storageAccounts', variables('auditStorageAccount'))]&quot;,
                          &quot;[resourceId('Microsoft.Sql/servers', variables('uniqueSQLName'))]&quot;
                      ],
                      &quot;properties&quot;: {
                          &quot;roleDefinitionId&quot;: &quot;[variables('StorageBlobContributor')]&quot;,
                          &quot;principalId&quot;: &quot;[reference(resourceId('Microsoft.Sql/servers', variables('uniqueSQLName')), '2019-06-01-preview', 'Full').identity.principalId]&quot;,
                          &quot;scope&quot;: &quot;[resourceId('Microsoft.Storage/storageAccounts', variables('auditStorageAccount'))]&quot;,
                          &quot;principalType&quot;: &quot;ServicePrincipal&quot;
                      }
                  }
              ]
          }
  </code></pre>
  <p>My assumption was that having it as a sub-resource would ensure that it was in place for anything that then had a dependsOn to the Storage Account</p>