Getting does not have authorization to perform action or scope is invalid.

Question

We're getting the following error 'The client 'f774a339-7628-49ff-9829-49c522b6d49c' with object id 'f774a339-7628-49ff-9829-49c522b6d49c' does not have the authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/read' over scope '/subscriptions/3535caf0-dd76-4e49-8666-cdbb6f15aa55' or the scope is invalid. If access was recently granted, please refresh your credentials.' We've already given a Contributor role and added a few custom roles such as:

1.'Microsoft.Authorization//write', 2.'Microsoft.Authorization//read', 3.'Microsoft.Resources/subscriptions/', 4.'Microsoft.Resources/subscriptions/resourceGroups/', 5.'Microsoft.Resources/subscriptions/resourcegroups/resources/', 6.'Microsoft.Resources/subscriptions/resources/', 7.'Microsoft.Resources/subscriptions/locations/*'

Still facing the same issue.

Answer 1

@Kalyani Wani

The error is not related to the user but to the application. Kindly look for application/SPN name with client ID: 'f774a339-7628-49ff-9829-49c522b6d49c.

Navigate to the subscription > Choose the subscription > Add Role assignment > Reader > assign to the application SPN:

Thanks,

Akshay Kaushik

Answer 2

make sure you are in the right subscription. after you login with "Connect-AzAccount" go to "Select-AzSubscription -SubscriptionName 'X'

Answer 3

Following the steps here helped me "https://learn.microsoft.com/en-us/azure/cosmos-db/managed-identity-based-authentication?tryIt=true&source=docs#code-try-1". I had to add a custom role from Azure Command shell to get access