How to get through this error please?

Question

I am trying to learn about vnet peering in the azure cloud. I have two active certs. It tells me to renew a cert to get access to the labs. How to correct this so I can get moving?

(AuthorizationFailed) The client 'live.com#stevenbwinters@hotmail.com' with object id '327a4d14-a3b7-4faa-96c4-b95045d8c9b8' does not have authorization to perform action 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write' over scope '/subscriptions/15d8a956-80fb-4ce9-9ddc-722e26d3ba5a/resourceGroups/steverg/providers/Microsoft.Network/virtualNetworks/SalesVNet/virtualNetworkPeerings/SalesVNet-To-MarketingVNet' or the scope is invalid. If access was recently granted, please refresh your credentials.

Code: AuthorizationFailed

Message: The client 'live.com#stevenbwinters@hotmail.com' with object id '327a4d14-a3b7-4faa-96c4-b95045d8c9b8' does not have authorization to perform action 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write' over scope '/subscriptions/15d8a956-80fb-4ce9-9ddc-722e26d3ba5a/resourceGroups/steverg/providers/Microsoft.Network/virtualNetworks/SalesVNet/virtualNetworkPeerings/SalesVNet-To-MarketingVNet' or the scope is invalid. If access was recently granted, please refresh your credentials.

stevenbwinters [ ~ ]$

Answer 1

Hello @Steven Winters ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are trying to configure Azure Vnet peering but it is failing with the following error: "(AuthorizationFailed) The client 'live.com#stevenbwinters@hotmail.com' with object id '327a4d14-a3b7-4faa-96c4-b95045d8c9b8' does not have authorization to perform action 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write' over scope '/subscriptions/15d8a956-80fb-4ce9-9ddc-722e26d3ba5a/resourceGroups/steverg/providers/Microsoft.Network/virtualNetworks/SalesVNet/virtualNetworkPeerings/SalesVNet-To-MarketingVNet' or the scope is invalid. If access was recently granted, please refresh your credentials".

Are both the Vnets in the same subscription or different subscriptions under the same AD tenant?

You need an Azure account with permissions in both subscriptions OR an account in each subscription with the proper permissions to create a virtual network peering.

The error says that the client does not have authorization. So, I would request you to check the permissions for that clientid.

Kindly look for user account with client ID: '327a4d14-a3b7-4faa-96c4-b95045d8c9b8'.

Navigate to the subscription > Choose the subscription > Add Role assignment > Select role "Network Contributor" for the 'Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write' permissions > assign to the user account.

Refer: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/networking#network-contributor

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-troubleshoot-peering-issues#the-virtual-networks-are-in-different-subscriptions-or-active-directory-tenants

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering?tabs=peering-portal#permissions

https://learn.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions?tabs=create-peering-portal#prerequisites

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.