Error: The client does not have authorization to perform action 'Microsoft.Web/sites/config/list/action'

Question

I'm getting an error message when trying to run a WebJob:

The client does not have authorization to perform action 'Microsoft.Web/sites/config/list/action' over scope '/subscriptions/[redacted]/resourceGroups/[redacted]/providers/Microsoft.Web/sites/[redacted]/config/publishingcredentials'

Based on this information, how do I determine which role to add, and where?

Note: I do NOT want to grant Contributor access to my registered application. I consider that to be a sloppy approach to security; I prefer the 'least privilege' rule in these matters.

My question is about how to translate the information from the error message (i.e. "action 'Microsoft.Web/sites/config/list/action'") into the actual IAM permissions I must grant to my application.

Answer 1

Hi, Jeff

You can take that error message, then reference: Azure built-in roles

What I usually do is do a Find (Ctrl+F) on the page for the permissions for example if we take a look at:

• Microsoft.Web/sites/config/list/action

There is nothing there, so lets go back to:

• Microsoft.Web/sites/config/list

Theres nothing, up until:

Microsoft.Web/sites/*	Create and manage websites (site creation also requires write permissions to the associated App Service Plan)

The wildcard (*) represents everything, underneath including list and action/write etc.

In this example the rights are: Website Contributor.

You could either give the user Website Contributor rights, or create your own custom role, with the specific permission that they need.

Answer 2

@Luke Murray

Even cooler place to get the list of RBAC Action is by going on ['Azure resource provider operations'] and searching for the action.

And even more cooler is to use Azure Powershell:

Get-AzProviderOperation Microsoft.Web/sites/config/*

I love the powershell way !