Set up a Runbook using Managed Identity for a SQL Server for VCore change

Question

Hi, I believe I have set up both a System Assigned and User Assigned identities to try and run a notebook that will simply change the vcore of a database. However when ever I run either way I get the following errors System: Get-AzSqlInstance : The client 'yyy' with object id 'yyy' does not have authorization to perform action 'Microsoft.Sql/managedInstances/read' over scope '/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Sql/managedInstances/UAT' or the scope is invalid. If access was recently granted, please refresh your credentials. At line:74 char:10 + $sqlMI = Get-AzSqlInstance -Name $MIName -ResourceGroupName $Resource ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : CloseError: (:) [Get-AzSqlInstance], CloudException + FullyQualifiedErrorId : Microsoft.Azure.Commands.Sql.ManagedInstance.Cmdlet.GetAzureSqlManagedInstance User: Get-AzSqlInstance : The client 'xxx' with object id 'xxx' does not have authorization to perform action 'Microsoft.Sql/managedInstances/read' over scope '/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Sql/managedInstances/UAT' or the scope is invalid. If access was recently granted, please refresh your credentials. At line:74 char:10 + $sqlMI = Get-AzSqlInstance -Name $MIName -ResourceGroupName $Resource ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : CloseError: (:) [Get-AzSqlInstance], CloudException + FullyQualifiedErrorId : Microsoft.Azure.Commands.Sql.ManagedInstance.Cmdlet.GetAzureSqlManagedInstance both identities have owner / contributor access on the SQL Server in question

Answer 1

@Anonymous Thanks for reaching out. Based on the information provided, seems you have not provided required permissions for the system assigned identity or user managed identity. You can provide the role SQL Security Manager which lets you manage the security -related policies of SQL servers and databases. On how to provide access to Managed identity, you can refer this article.