# coding=utf-8
# --------------------------------------------------------------------------
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License. See License.txt in the project root for license information.
# Code generated by Microsoft (R) Python Code Generator.
# Changes may cause incorrect behavior and will be lost if the code is regenerated.
# --------------------------------------------------------------------------

from azure.identity import DefaultAzureCredential

from azure.mgmt.authorization import AuthorizationManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-authorization
# USAGE
    python deny_assignments_create_for_subscription.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = AuthorizationManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.deny_assignments.create_or_update(
        scope="subscriptions/a925f2f7-5c63-4b7b-8799-25a5f97bc3b2",
        deny_assignment_id="64b75d79-7a26-4341-944e-4f1a19f0e6ca",
        parameters={
            "properties": {
                "denyAssignmentEffect": "enforced",
                "denyAssignmentName": "Deny delete on critical resources",
                "description": "Prevent all users from deleting critical resources in the subscription.",
                "doNotApplyToChildScopes": False,
                "excludePrincipals": [{"id": "ce2ce14e-85d7-4629-bdbc-454d0519d987", "type": "ServicePrincipal"}],
                "permissions": [{"actions": ["*/delete"], "dataActions": [], "notActions": [], "notDataActions": []}],
                "principals": [{"id": "00000000-0000-0000-0000-000000000000", "type": "SystemDefined"}],
            }
        },
    )
    print(response)


# x-ms-original-file: 2024-07-01-preview/DenyAssignments_CreateForSubscription.json
if __name__ == "__main__":
    main()
