What permissions do I need to check status of a Purview account update operation?

Question

What permissions do I need to check status of a Purview account update operation?

SnurovasAleksandras-3884 40

Hi community!

I am adding a User Assigned Managed Identity to the Purview account resource using this endpoint:

https://learn.microsoft.com/en-us/rest/api/purview/accounts/update?view=rest-purview-2021-07-01&tabs=HTTP

I authenticate using a service principal that has resource group scoped Contributor role. The Purview account is in the same resource group.

When submitting an update request, I receive a status check link in the response header (location).

However, the service principal does not have read permissions to check the status via the link, and the status check request returns a 403:

The client 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' with object id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' does not have authorization to perform action 'Microsoft.Purview/locations/operationResults/read' over scope '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/providers/Microsoft.Purview/locations/southcentralus/operationResults/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' or the scope is invalid. If access was recently granted, please refresh your credentials.

I am guessing here, but maybe it requires resource read permission on the Purview provider itself, or it needs a subscription level permission.

Either way, it is strange that the client who initiated the update, cannot check the status of the update operation.

Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2023-12-12T20:15:04.0333333+00:00

Hello SnurovasAleksandras-3884,

Welcome to the Microsoft Q&A forum.

The error message indicates that the service principal lacks the necessary permissions to perform the ‘Microsoft.Purview/locations/operationResults/read’ action.

To resolve this:

Create a custom role "Microsoft.Purview/locations/operationResults/read" from the IAM page

and provide those permissions to the SPN

To create a custom role:

Navigate to subcription

Go to IAM

Add custom role (from +Add )

add the custom role.

after adding the custom role, select member and assign that new role to the SPN

https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

I hope this helps.
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2023-12-16T00:12:49.6666667+00:00

Hello SnurovasAleksandras-3884,

I am checking to see if you had a chance to look into the earlier response. Please let me knwo if you have any further questions.

Accepted answer

1 additional answer

Your answer

Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2023-12-12T20:15:04.0333333+00:00

Hello SnurovasAleksandras-3884,

Welcome to the Microsoft Q&A forum.

The error message indicates that the service principal lacks the necessary permissions to perform the ‘Microsoft.Purview/locations/operationResults/read’ action.

To resolve this:

Create a custom role "Microsoft.Purview/locations/operationResults/read" from the IAM page

and provide those permissions to the SPN

To create a custom role:

Navigate to subcription

Go to IAM

Add custom role (from +Add )

add the custom role.

after adding the custom role, select member and assign that new role to the SPN

https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

I hope this helps.
Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2023-12-16T00:12:49.6666667+00:00

Hello SnurovasAleksandras-3884,

I am checking to see if you had a chance to look into the earlier response. Please let me knwo if you have any further questions.

Answer 1

Hello SnurovasAleksandras-3884,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others (Opens in new window or tab)", I'll repost your solution in case you'd like to "Accept (Opens in new window or tab)" the answer.

Issue: When submitting an update request in purview, receiving a status check link in the response header.

Error:

The client 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' with object id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' does not have authorization to perform action 'Microsoft.Purview/locations/operationResults/read' over scope '/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/providers/Microsoft.Purview/locations/southcentralus/operationResults/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' or the scope is invalid. If access was recently granted, please refresh your credentials.

Solution:

The service principal does not have read permissions to check the status and returned a 403 error.

This issue was resolved by assigning the service principal to the Reader role at the subscription level.

If you have any other questions or are still running into more issues, please let me know.
Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

SnurovasAleksandras-3884 40

Assigning service principal to the Reader role on subscription level seems to have fixed the issue.

Bhargava-MSFT 31,261 Reputation points Microsoft Employee Moderator

2023-12-22T20:50:02.74+00:00

Thank you, SnurovasAleksandras-3884 for providing the details.

I am curious to know, did you get a chance to create a custom role "Microsoft.Purview/locations/operationResults/read" from the IAM page and provide those permissions to the SPN? This will grant the necessary granular level of permissions to perform the action over the specified scope.

Share via

What permissions do I need to check status of a Purview account update operation?

1 additional answer

Your answer