Add subscription and tenant scope support for Azure resources

[Copilot]

Description

Implements subscription and tenant scoping for Azure resources, extending the existing resource group scoping from PR #11150.

Core Changes

API Extensions - Added new methods to ExistingAzureResourceExtensions with clearer naming:

Subscription-scoped methods:

• AsExistingInSubscription(), RunAsExistingInSubscription(), PublishAsExistingInSubscription()

Resource group with subscription methods:

• AsExistingInResourceGroup(), RunAsExistingInResourceGroup(), PublishAsExistingInResourceGroup()

Tenant-scoped methods:

• AsExistingInTenant(), RunAsExistingInTenant(), PublishAsExistingInTenant()

All methods support both string and ParameterResource variants.

Annotations & Scope

• ExistingAzureResourceAnnotation: Added Subscription and Tenant properties with constructors
• AzureBicepResourceScope: Added subscription-only and tenant-only scope constructors
• Manifest serialization includes subscription/tenant when specified

Bicep Generation

• Generates subscription(subId) for subscription-scoped resources
• Generates resourceGroup(subId, rgName) for cross-subscription resource groups
• Generates tenant(tenantId) for tenant-scoped resources
• Role assignments respect scope hierarchy

Example Usage

// Subscription-scoped resource
var resource = builder.AddAzureResource("res")
    .AsExistingInSubscription(nameParam, subscriptionParam);

// Cross-subscription resource group scope
var serviceBus = builder.AddAzureServiceBus("sb")
    .PublishAsExistingInResourceGroup(nameParam, resourceGroupParam, subscriptionParam);

// Tenant-scoped resource
var resource = builder.AddAzureResource("res")
    .AsExistingInTenant(nameParam, resourceGroupParam, subscriptionParam, tenantParam);

Implementation Notes

• Backward compatible - existing AsExisting(name, resourceGroup) methods unchanged
• Scope hierarchy: tenant > subscription > resource group (priority-based selection)
• Refactored scope property setting to reduce duplication

Fixes #11150 (partial - adds tenant support on top of subscription support)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No
• Does the change require an update in our Aspire docs?
  • Yes
    • Link to aspire-docs issue: To be created after PR approval - will document subscription and tenant scoping parameters for existing Azure resources
  • No

Original prompt

Open a pull request with the contents from #11150 and also add support for tenant scoped resources.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 13121

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 13121"

[David Fowler (davidfowl)]

Here Victor Vazquez (@vhvb1989)

[David Fowler (davidfowl)]

Copilot let’s try adding new methods to handle the scenarios.

AsExisting is too overloaded, let’s try AsExistingSubscription, AsExistingResourceGroup, AsExistingTenant

[Copilot]

Copilot let’s try adding new methods to handle the scenarios.

AsExisting is too overloaded, let’s try AsExistingSubscription, AsExistingResourceGroup, AsExistingTenant

Done in c2d4b81. Renamed the overloaded AsExisting methods to clearer names:

• AsExistingInSubscription - for subscription-scoped resources
• AsExistingInResourceGroup - for resource group with subscription scope
• AsExistingInTenant - for tenant-scoped resources

Same pattern applied to RunAsExisting* and PublishAsExisting* variants.

[Victor Vazquez (vhvb1989)]

Will you be able to deploy to multiple tenants at the same time? 😮🫨

[github-actions]

🎬 CLI E2E Test Recordings

The following terminal recordings are available for commit 46868c9:

Test	Recording
CreateAndDeployToDockerCompose	▶️ View Recording
CreateAndDeployToDockerComposeInteractive	▶️ View Recording
CreateAndRunAspireStarterProject	▶️ View Recording
CreateAndRunJsReactProject	▶️ View Recording
CreateAndRunPythonReactProject	▶️ View Recording
CreateEmptyAppHostProject	▶️ View Recording
CreateStartAndStopAspireProject	▶️ View Recording
CreateTypeScriptAppHostWithViteApp	▶️ View Recording
DoctorCommand_WithSslCertDir_ShowsTrusted	▶️ View Recording
DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	▶️ View Recording

---

_{📹 Recordings uploaded automatically from CI run #21242508343}

[David Fowler (davidfowl)]

Closing this stale draft in favor of #17988, which ports the work forward to current main, adds deploy-path fixes and tests, and has been live-validated in Azure.