Which permissions do I need to be able to register a service in our company subscription?

@Martin Hoch Thanks for reaching out to Microsoft Q&A, apologize for any inconvenience caused on this. If a particular user is assigned with either owner or contributor access at subscription level, then he/she will be able to register all the resource provider. If you want to limit the particular user access to register only some specific resource provider, then you can create custom role and assign the permissions as shown below. Microsoft.web/register/action --> Register Microsoft.Web resource provider for the subscription. Microsoft.CognitiveSearch/register/action --> Register the subscription for Microsoft.CognitiveSearch provider. For more information, refer to these documentation Supported different resource provider operations . How to create a custom roles using either Portal, PowerShell or through any other methods. Feel free to reach back to me if you have any further questions on this.

Permissions to register a service

Accepted answer

VenkateshDodda-MSFT 19,746 Reputation points Microsoft Employee

2023-09-05T04:57:00.8666667+00:00
@Martin Hoch Thanks for reaching out to Microsoft Q&A, apologize for any inconvenience caused on this.

If a particular user is assigned with either owner or contributor access at subscription level, then he/she will be able to register all the resource provider.

If you want to limit the particular user access to register only some specific resource provider, then you can create custom role and assign the permissions as shown below.

Microsoft.web/register/action --> Register Microsoft.Web resource provider for the subscription. Microsoft.CognitiveSearch/register/action --> Register the subscription for Microsoft.CognitiveSearch provider.

For more information, refer to these documentation

Supported different resource provider operations.

How to create a custom roles using either Portal, PowerShell or through any other methods.

Feel free to reach back to me if you have any further questions on this.
Please sign in to rate this answer.
Martin Hoch 20 Reputation points

2023-09-06T09:52:01.7666667+00:00

Hello @VenkateshDodda-MSFT ,
The response helped, I got contributor role to the subscription and I am able to register resources, but I get another error:

*InvalidTemplateDeployment: The template deployment failed with error: 'Authorization failed for template resource '123456' of type 'Microsoft.Authorization/roleAssignments'. The client 'example@domain.com' with object id '123456' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/123456/resourceGroups/rg-resourcegroup/providers/Microsoft.Authorization/roleAssignments/123456'.'
*
Is it possible to have the authorization to assign roles without having the owner role?

BTW I am trying to run this sample: https://github.com/Azure-Samples/azure-search-openai-demo, do you have any idea, why does it need to assign roles?

Thank you very much, Martin.

VenkateshDodda-MSFT 19,746 Reputation points Microsoft Employee

2023-09-06T11:47:49.88+00:00

@Martin Hoch Thanks for your response. In the above shared Github repo sample it is clearly called that you need have these permissions to run the sample Microsoft.Authorization/roleAssignments/write permissions, such as User Access Administrator or Owner.

Is it possible to have the authorization to assign roles without having the owner role? --> You need to have User Access Administrator.

I have reviewed the code in the shared GitHub repo, based on my understanding I can see that under infra/core/main.bicep file you are creating app service with managed identities and assigning the below roles to access the cognitive search, storage account resources.

Cognitive Services OpenAI User, Storage Blob Data Reader, Storage Blob Data Contributor, Search Index Data Reader, Search Index Data Contributor

Feel free to reach back to me if you have any further questions on this.

Martin Hoch 20 Reputation points

2023-09-08T06:56:33.18+00:00

Hello, thank you for the response. It solved the problem. Martin.

VenkateshDodda-MSFT 19,746 Reputation points Microsoft Employee

2023-09-08T07:49:07.6666667+00:00

@Martin Hoch Thanks for your response, glad to know that your problem has resolved. I have converted my comment to answer.

Please accept as Yes if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Permissions to register a service

0 additional answers

Your answer