get error on EnsureClusterIdentityHasRbacToSelfManagedResources about aks-baseline-regulated

[ckittel]

Sorry for the delay @liuzhiyong1982 -- when you get the "Tenant ID, application ID, principal ID, and scope are not allowed to be updated." message, that usually means that you have a lingering role assignment that exists from a prior deployment that wasn't deleted. For example, you deleted the resource group that contains the cluster and its adjacent, but didn't remove the managed identity assignment from the subnets that are managed by the prior cluster's identities. Each subnet is a resource that has its own role assignments in this case. Internally we run into this a lot when we are creating and doing partial deletes on resources to keep the inner loop tight :)

Let me know if you have any more questions.

[ckittel]

Going to close this one as there haven't been any updates in about a month. Feel free to open a new issue or this one to continue the conversation. Thanks!