Permissions to register a service

Question

Permissions to register a service

Martin Hoch 20

Which permissions do I need to be able to register a service in our company subscription?
User's image

VenkateshDodda-MSFT 12,091 Reputation points Microsoft Employee

2023-09-06T04:21:49.2966667+00:00

Hello @Martin Hoch ,

Following up to see if you have a chance to check my previous response and helped. Do let us know if you have any further questions on this.
VenkateshDodda-MSFT 12,091 Reputation points Microsoft Employee

2023-09-08T03:27:35.24+00:00

Hello @Martin Hoch ,

Following up to see if you have a chance to check my previous response and helped. Do let us know if you have any further questions on this.

VenkateshDodda-MSFT 12,091 Reputation points Microsoft Employee

2023-09-06T04:21:49.2966667+00:00

Hello @Martin Hoch ,

Following up to see if you have a chance to check my previous response and helped. Do let us know if you have any further questions on this.
VenkateshDodda-MSFT 12,091 Reputation points Microsoft Employee

2023-09-08T03:27:35.24+00:00

Hello @Martin Hoch ,

Following up to see if you have a chance to check my previous response and helped. Do let us know if you have any further questions on this.

Answer 1

VenkateshDodda-MSFT 12,091 Microsoft Employee

@Martin Hoch Thanks for reaching out to Microsoft Q&A, apologize for any inconvenience caused on this.

If a particular user is assigned with either owner or contributor access at subscription level, then he/she will be able to register all the resource provider.

If you want to limit the particular user access to register only some specific resource provider, then you can create custom role and assign the permissions as shown below.

Microsoft.web/register/action --> Register Microsoft.Web resource provider for the subscription.
Microsoft.CognitiveSearch/register/action --> Register the subscription for Microsoft.CognitiveSearch provider.

For more information, refer to these documentation

Supported different resource provider operations.
How to create a custom roles using either Portal, PowerShell or through any other methods.

Feel free to reach back to me if you have any further questions on this.

Martin Hoch 20 Reputation points

2023-09-06T09:52:01.7666667+00:00

Hello @VenkateshDodda-MSFT ,
The response helped, I got contributor role to the subscription and I am able to register resources, but I get another error:

*InvalidTemplateDeployment: The template deployment failed with error: 'Authorization failed for template resource '123456' of type 'Microsoft.Authorization/roleAssignments'. The client 'example@domain.com' with object id '123456' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/123456/resourceGroups/rg-resourcegroup/providers/Microsoft.Authorization/roleAssignments/123456'.'
*
Is it possible to have the authorization to assign roles without having the owner role?

BTW I am trying to run this sample: https://github.com/Azure-Samples/azure-search-openai-demo, do you have any idea, why does it need to assign roles?

Thank you very much, Martin.
VenkateshDodda-MSFT 12,091 Reputation points Microsoft Employee

2023-09-06T11:47:49.88+00:00

@Martin Hoch Thanks for your response. In the above shared Github repo sample it is clearly called that you need have these permissions to run the sample Microsoft.Authorization/roleAssignments/write permissions, such as User Access Administrator or Owner.

Is it possible to have the authorization to assign roles without having the owner role? --> You need to have User Access Administrator.

I have reviewed the code in the shared GitHub repo, based on my understanding I can see that under infra/core/main.bicep file you are creating app service with managed identities and assigning the below roles to access the cognitive search, storage account resources.

Cognitive Services OpenAI User, Storage Blob Data Reader, Storage Blob Data Contributor, Search Index Data Reader, Search Index Data Contributor

Feel free to reach back to me if you have any further questions on this.
Martin Hoch 20 Reputation points

2023-09-08T06:56:33.18+00:00

Hello, thank you for the response. It solved the problem. Martin.
VenkateshDodda-MSFT 12,091 Reputation points Microsoft Employee

2023-09-08T07:49:07.6666667+00:00

@Martin Hoch Thanks for your response, glad to know that your problem has resolved. I have converted my comment to answer.

Please accept as Yes if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Permissions to register a service

0 additional answers

Activity