Getting does not have authorization to perform action or scope is invalid.

Question

Getting does not have authorization to perform action or scope is invalid.

Kalyani Wani 90

We're getting the following error 'The client 'f774a339-7628-49ff-9829-49c522b6d49c' with object id 'f774a339-7628-49ff-9829-49c522b6d49c' does not have the authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/read' over scope '/subscriptions/3535caf0-dd76-4e49-8666-cdbb6f15aa55' or the scope is invalid. If access was recently granted, please refresh your credentials.' We've already given a Contributor role and added a few custom roles such as:

1.'Microsoft.Authorization//write', 2.'Microsoft.Authorization//read', 3.'Microsoft.Resources/subscriptions/', 4.'Microsoft.Resources/subscriptions/resourceGroups/', 5.'Microsoft.Resources/subscriptions/resourcegroups/resources/', 6.'Microsoft.Resources/subscriptions/resources/', 7.'Microsoft.Resources/subscriptions/locations/*'

Still facing the same issue.

Andy David - MVP 157.4K Reputation points MVP Volunteer Moderator

2023-01-24T12:34:48.35+00:00

If you go the subscription and Access Control (IAM ), "Check Access" , what does is show for access for that security principal you gave the permissions to?
Kalyani Wani 90 Reputation points

2023-01-24T12:47:13.46+00:00

I gave permissions to specific user, by selecting User,Group and service principal.
Andy David - MVP 157.4K Reputation points MVP Volunteer Moderator

2023-01-24T12:50:07.85+00:00

Hi, can you verify what access it has in the subscription?

[https://learn.microsoft.com/en-us/azure/role-based-access-control/check-access#step-2-check-access-for-a-user
Kalyani Wani 90 Reputation points

2023-01-24T13:32:41.4966667+00:00

I've provided Contributor role to the user, as shown in the image.
Also I've created custom roles, as mentioned in above message.
tg-5656 15 Reputation points

2023-09-01T08:04:49.6233333+00:00

In my case the search process not find my profile.
Yinka Idowu 5 Reputation points Microsoft Employee

2024-07-24T20:55:40.52+00:00

In addition, make sure you have the right subscription context within your tenant. You can confirm and ensure the subscription is indeed the correct one from the overview page of the SQL server resource in Azure portal. Run the command below to set your context.

Set-AzContext -Subscription 3535caf0-dd76-4e49-8666-cdbb6f15aa55
joseville 0 Reputation points Microsoft Employee

2024-09-17T20:55:35.5533333+00:00

Setting the subscription in the context was what finally worked for me.

az account set --subscription "<subId>" if using Bash, otherwise see Yinka Idowu's 7/24/24 comment if using PowerShell: Set-AzContext -Subscription <subId>

4 answers

Your answer

Andy David - MVP 157.4K Reputation points MVP Volunteer Moderator

2023-01-24T12:34:48.35+00:00

If you go the subscription and Access Control (IAM ), "Check Access" , what does is show for access for that security principal you gave the permissions to?
Kalyani Wani 90 Reputation points

2023-01-24T12:47:13.46+00:00

I gave permissions to specific user, by selecting User,Group and service principal.
Andy David - MVP 157.4K Reputation points MVP Volunteer Moderator

2023-01-24T12:50:07.85+00:00

Hi, can you verify what access it has in the subscription?

[https://learn.microsoft.com/en-us/azure/role-based-access-control/check-access#step-2-check-access-for-a-user
Kalyani Wani 90 Reputation points

2023-01-24T13:32:41.4966667+00:00

I've provided Contributor role to the user, as shown in the image.
Also I've created custom roles, as mentioned in above message.
tg-5656 15 Reputation points

2023-09-01T08:04:49.6233333+00:00

In my case the search process not find my profile.
Yinka Idowu 5 Reputation points Microsoft Employee

2024-07-24T20:55:40.52+00:00

In addition, make sure you have the right subscription context within your tenant. You can confirm and ensure the subscription is indeed the correct one from the overview page of the SQL server resource in Azure portal. Run the command below to set your context.

Set-AzContext -Subscription 3535caf0-dd76-4e49-8666-cdbb6f15aa55
joseville 0 Reputation points Microsoft Employee

2024-09-17T20:55:35.5533333+00:00

Setting the subscription in the context was what finally worked for me.

az account set --subscription "<subId>" if using Bash, otherwise see Yinka Idowu's 7/24/24 comment if using PowerShell: Set-AzContext -Subscription <subId>

Answer 1

Akshay-MSFT 17,951 Microsoft Employee Moderator

@Kalyani Wani

The error is not related to the user but to the application. Kindly look for application/SPN name with client ID: 'f774a339-7628-49ff-9829-49c522b6d49c.

Navigate to the subscription > Choose the subscription > Add Role assignment > Reader > assign to the application SPN:

User's image

Thanks,

Akshay Kaushik

Admin iSS 0 Reputation points

2023-10-31T01:44:35.4+00:00

Kudos! Worked like a charm!
Akshay-MSFT 17,951 Reputation points Microsoft Employee Moderator

2023-10-31T04:18:13.8+00:00

@Kalyani Wani

Thank you for taking time to share your feedback.

Since we were able to clarify the response in the above answer, I request that you would "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Thanks,

Akshay Kaushik
Muhammad Rahman 1 Reputation point

2024-01-24T02:00:28.15+00:00

I think I'm having the same issue even though I am using Azure Global Admin user in my subscription. Using the same user, I never had this issue before. Now, I even cannot edit/create/delete any resources in my subscription.
I attached my user roles in the following screenshot:

Any idea?
Thanks
manas 0 Reputation points

2024-09-03T14:47:22.27+00:00

This works. Just assign the service principal the role of reader and the api call works like a charm.

Answer 2

TWA 20

make sure you are in the right subscription. after you login with "Connect-AzAccount" go to "Select-AzSubscription -SubscriptionName 'X'

Answer 3

Phạm Như Long 5

{BC2D9396-1E6A-4A7A-BC38-6DC77654B9F8}

I am experiencing the same issue as mentioned above. I am the owner of the project, but I don’t understand why I don’t have any permissions to remove in deny assignment and I also don't have permission to add new role too.

Answer 4

Rohan Krishna Ullas 10 Microsoft Employee

Following the steps here helped me "https://learn.microsoft.com/en-us/azure/cosmos-db/managed-identity-based-authentication?tryIt=true&source=docs#code-try-1". I had to add a custom role from Azure Command shell to get access

Share via

Getting does not have authorization to perform action or scope is invalid.

4 answers

Your answer