Event Grid Tenant Lifecycle to Provisioning

Overview

This flow turns Azure tenant-lifecycle events into automated, standardized landing-zone provisioning. It subscribes (via Azure Event Grid) to resource-group / subscription creation events and, for each genuine resource-group creation, runs a consistent provisioning routine: apply mandatory governance tags, create a hardened baseline storage account, assign baseline RBAC, record the new tenant in a Dataverse inventory table, and notify the platform team in Teams.

Why it matters: manually configuring every new environment is slow and inconsistent. Event-driven provisioning enforces standards from the moment a resource group exists, giving the platform team a complete, auditable inventory of every landing zone.

Ships Off (demo).

Use Case

A platform/landing-zone team wants every new resource group (or subscription) to auto-configure to an organizational standard the instant it is created - tags for cost/ownership governance, a baseline diagnostics storage account, a baseline RBAC grant, and an inventory record - with a real-time Teams notification.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Azure Event Grid	shared_azureeventgrid	CreateSubscription (trigger)
Azure Resource Manager	shared_arm	Resources_CreateOrUpdateById
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord
Microsoft Teams	shared_teams	PostMessageToConversation

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Tags / policy

Edit the baseline tags JSON; extend Apply Required Tags or add an Azure Policy assignment via another Resources_CreateOrUpdateById to policyAssignments.

Baseline resources

Swap or add resources with more Resources_CreateOrUpdateById actions, or deploy the full baseline template via a Deployments_CreateOrUpdate action.

RBAC

Change the role definition GUID (e.g. Contributor) and the principal id.

Scope filter

Adjust the trigger includedEventTypes or the guard condition to target subscriptions or specific providers.

Approval gate

Insert an Approvals StartAndWaitForAnApproval before production provisioning.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

and(contains(toLower(variables('varEventSubject')),'/resourcegroups/'), equals(length(split(variables('varEventSubject')),'/')),5))

toLower(concat('flbz', substring(replace(variables('varCorrelationId'),'-',''),0,16)))

@json(concat('{"roleDefinitionId":"/subscriptions/', variables('varSubId'), '/providers/Microsoft.Authorization/roleDefinitions/', variables('varRoleGuid'), '","principalId":"', variables('varPrincipalId'), '","principalType":"ServicePrincipal"}'))

Customize & download