This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 34%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAY%3C/text%3E%3C/svg%3E)
We have created a new azure subscription with vnet. but when I tried to use it for one of the azure resource, I am getting the below error: I have already activated PIM roles. Missing write permissions ('Microsoft.Network/virtualNetworks/write') for the following virtual network(s): 'vnt-300462-az01'. Write permission is required to enable service endpoints for 'Microsoft.CognitiveServices'.
Hello @Avraham Yehoshua ,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
I understand that you are unable to use your existing Vnet when enabling service endpoint for 'Microsoft.CognitiveServices'.
As mentioned by @Dillon Silzer below, you need to check the permissions on the Vnet by browsing to Access Control (IAM).
Per the Configure Azure AI services virtual networks document,
To apply a virtual network rule to an Azure AI services resource, you need the appropriate permissions for the subnets to add. The required permission is the default Contributor role or the Cognitive Services Contributor role. Required permissions can also be added to custom role definitions. The Azure AI services resource and the virtual networks that are granted access might be in different subscriptions, including subscriptions that are part of a different Microsoft Entra tenant.
Also, as per the service endpoint document,
Service endpoints can be configured on virtual networks independently by a user with write access to a virtual network. To secure Azure service resources to a VNet, the user must have permission to Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action for the added subnets. The built-in service administrator roles include this permission by default. You can modify the permission by creating custom roles.
So, please check the permissions again and make sure that the Vnet has the required roles.
Regards,
Gita
@Avraham Yehoshua , could you please provide an update on this post?
Kindly let us know if you need further assistance on this issue.
Hi Avraham,
The easiest way to find this out is to open the Vnet > Access control (IAM):
Then under Check access > go to View my access
A window will pop up with your access to this specific resource.
If this is helpful please accept answer.