Error "does not have authorization to perform action 'Microsoft.ContainerService/register/action'" when trying to create a Container Apps environments to use existing Virtual Network

Question

Error "does not have authorization to perform action 'Microsoft.ContainerService/register/action'" when trying to create a Container Apps environments to use existing Virtual Network

Tung Nguyen Xuan 70

As in the title, I'm having problem creating a container apps environment that uses existing virtual network.
The error also persists if I create a new virtual network using "Create new" option during creating the container apps environment. I thought ContainerService is only required for AKS, as shown here
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-services-resource-providers

Prrudram-MSFT 28,366 Reputation points Microsoft Employee Moderator

2024-10-29T05:41:31.4733333+00:00
Hello @Tung Nguyen Xuan

The error message you are seeing indicates that the user or service principal you are using to create the Container Apps environment does not have the necessary permissions to register the Microsoft.ContainerService resource provider.
To resolve this issue, you can grant the necessary permissions to the user or service principal by following these steps:

Open the Azure portal and navigate to the subscription that contains the virtual network you want to use for your Container Apps environment.

Click on "Access control (IAM)" in the left-hand menu.

Click on the "+ Add" button and select "Add role assignment".

In the "Add role assignment" pane, select "Contributor" as the role and search for the user or service principal you want to grant permissions to.

Click on "Save" to add the role assignment.

Repeat steps 3-5 to add the "Network Contributor" role to the user or service principal.

Once you have granted the necessary permissions, you should be able to create the Container service environment using the existing virtual network without encountering the authorization error.
Explaination:
While it's true that ContainerService is primarily associated with AKS (Azure Kubernetes Service), it's also used in other Azure services, including Container Apps. Hence, Microsoft.ContainerService resource provider is required for you to create any containerized apps on the subscription.

Microsoft.ContainerService/register/action requires you to have contribution permission on subscription inorder to register this resource provider. What are the roles assigned you on this subscription?

If I have answered your question, please accept this as answer as a token of appreciation.
Tung Nguyen Xuan 70 Reputation points

2024-10-29T07:13:06.2033333+00:00

Why do I need this role for the user? FYI, Microsoft.ContainerService is not yet registered for this subscription, and the user (me) already has role Contributor to resource group
Prrudram-MSFT 28,366 Reputation points Microsoft Employee Moderator

2024-10-29T09:08:03.46+00:00

Hi @Tung Nguyen Xuan @Anonymous

We have noticed that you marked an answer as 'Not Helpful'. In order to turn around your experience with Q&A, Let me explain, why the above solution was recommended for you to resolve the error.

While it's true that ContainerService is primarily associated with AKS (Azure Kubernetes Service), it's also used in other Azure services, including Container Apps. Hence, Microsoft.ContainerService resource provider is required for you to create any containerized apps on the subscription.

Microsoft.ContainerService/register/action requires you to have contribution permission on subscription inorder to register this resource provider. What are the roles assigned you on this subscription?

If this answer is helpful, please accept it as answer and upvote. By doing so, you would help other community members with similar issues navigate to this right solution.
Tung Nguyen Xuan 70 Reputation points

2024-10-29T09:43:19.6866667+00:00

I don't even have the permissions to read role assignments at subscription scope. But is that relevant? Can't I simply ask the owner or someone with proper role to register Microsoft.ContainerService for me, and the problem would go away, as suggested here? https://learn.microsoft.com/en-us/azure/container-apps/vnet-custom?tabs=bash&pivots=azure-cli
Tung Nguyen Xuan 70 Reputation points

2024-10-29T09:49:20.0766667+00:00

@Prrudram-MSFT may you point me to the azure documentation where you get your information regarding ContainerService and Container Apps from? I want to read more into this.

Accepted answer

0 additional answers

Your answer

Prrudram-MSFT 28,366 Reputation points Microsoft Employee Moderator

2024-10-29T05:41:31.4733333+00:00

Hello @Tung Nguyen Xuan

The error message you are seeing indicates that the user or service principal you are using to create the Container Apps environment does not have the necessary permissions to register the Microsoft.ContainerService resource provider.
To resolve this issue, you can grant the necessary permissions to the user or service principal by following these steps:

Open the Azure portal and navigate to the subscription that contains the virtual network you want to use for your Container Apps environment.

Click on "Access control (IAM)" in the left-hand menu.

Click on the "+ Add" button and select "Add role assignment".

In the "Add role assignment" pane, select "Contributor" as the role and search for the user or service principal you want to grant permissions to.

Click on "Save" to add the role assignment.

Repeat steps 3-5 to add the "Network Contributor" role to the user or service principal.

Once you have granted the necessary permissions, you should be able to create the Container service environment using the existing virtual network without encountering the authorization error.
Explaination:
While it's true that ContainerService is primarily associated with AKS (Azure Kubernetes Service), it's also used in other Azure services, including Container Apps. Hence, Microsoft.ContainerService resource provider is required for you to create any containerized apps on the subscription.

Microsoft.ContainerService/register/action requires you to have contribution permission on subscription inorder to register this resource provider. What are the roles assigned you on this subscription?

If I have answered your question, please accept this as answer as a token of appreciation.
Tung Nguyen Xuan 70 Reputation points

2024-10-29T07:13:06.2033333+00:00

Why do I need this role for the user? FYI, Microsoft.ContainerService is not yet registered for this subscription, and the user (me) already has role Contributor to resource group
Prrudram-MSFT 28,366 Reputation points Microsoft Employee Moderator

2024-10-29T09:08:03.46+00:00

Hi @Tung Nguyen Xuan @Anonymous

We have noticed that you marked an answer as 'Not Helpful'. In order to turn around your experience with Q&A, Let me explain, why the above solution was recommended for you to resolve the error.

While it's true that ContainerService is primarily associated with AKS (Azure Kubernetes Service), it's also used in other Azure services, including Container Apps. Hence, Microsoft.ContainerService resource provider is required for you to create any containerized apps on the subscription.

Microsoft.ContainerService/register/action requires you to have contribution permission on subscription inorder to register this resource provider. What are the roles assigned you on this subscription?

If this answer is helpful, please accept it as answer and upvote. By doing so, you would help other community members with similar issues navigate to this right solution.
Tung Nguyen Xuan 70 Reputation points

2024-10-29T09:43:19.6866667+00:00

I don't even have the permissions to read role assignments at subscription scope. But is that relevant? Can't I simply ask the owner or someone with proper role to register Microsoft.ContainerService for me, and the problem would go away, as suggested here? https://learn.microsoft.com/en-us/azure/container-apps/vnet-custom?tabs=bash&pivots=azure-cli
Tung Nguyen Xuan 70 Reputation points

2024-10-29T09:49:20.0766667+00:00

@Prrudram-MSFT may you point me to the azure documentation where you get your information regarding ContainerService and Container Apps from? I want to read more into this.

Answer 1

Hi @Tung Nguyen Xuan

This isn't explicity covered in the container apps document, however you can see here in this section of creating an environment where the first step suggests to register Microsoft.ContainerService resource provider.

User's image

Additionally, the Microsoft.ContainerService resource provider is required for several Azure services, including:

Azure Kubernetes Service (AKS): For managing and orchestrating containerized applications using Kubernetes.

Azure Red Hat OpenShift: For deploying and managing containerized applications using Red Hat OpenShift.

Azure Container Apps: For executing event-driven, serverless code.

Azure Container Instances: For running containers without managing the underlying infrastructure.

Azure Service Fabric: For building, deploying, and managing scalable and reliable microservices using containers.

Solution: For your scenario. Yes, you could ask the owner or a contributor to register this service from the subscriptions->resource providers and then try creating a container app in the RG where you have permissions to create a resource.

User's image

If I have answered your question, please accept this as answer and upvote as a token of appreciation.

Share via

Error "does not have authorization to perform action 'Microsoft.ContainerService/register/action'" when trying to create a Container Apps environments to use existing Virtual Network

0 additional answers

Your answer