Authorization Error

Question

Authorization Error

Aadarsh Moudgil 10

The client 'live.com#******@gmail.com' with object id '36f32195-30d2-46b8-8333-328a293c9ce9' does not have authorization to perform action 'microsoft.app/register/action' over scope '/subscriptions/ad6d4767-abfb-4459-938a-55a306750cfa' or the sc

This question is related to the following Learning Module

1 answer

Your answer

Answer 1

Kiran P 8,255 Microsoft External Staff Volunteer Moderator

Hi Aadarsh Moudgil,

Thank you for reaching out to us on Microsoft Q&A forum.

This appears to be an authorization error. In short, your development team is trying to create a managed identity, but the corresponding resource provider is not registered.

Use an account with the Owner role in the subscription to register the Microsoft.ManagedIdentity provider

Follow https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-providers-and-types#register-resource-provider

f the above response helps answer your question, remember to "Accept Answer or Upvote" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

Thank you.

Kiran P 8,255 Reputation points Microsoft External Staff Volunteer Moderator

2024-09-17T04:50:55.61+00:00

Hi Aadarsh Moudgil,

Just checking in to see if you had a chance to see my previous answer. Please let me know if it was helpful and don't hesitate to reach out to us if you face any issue.

If you have found the answer provided to be helpful, please click on the "Accept answer/Upvote" button so that it is useful for other members in the Microsoft Q&A community.

Thank you.
Kiran P 8,255 Reputation points Microsoft External Staff Volunteer Moderator

2024-09-18T05:05:21.31+00:00

Hi Aadarsh Moudgil,

Just checking in to see if you had a chance to see my previous answer. Please let me know if it was helpful and don't hesitate to reach out to us if you face any issue.

If you have found the answer provided to be helpful, please click on the "Accept answer/Upvote" button so that it is useful for other members in the Microsoft Q&A community.

Thank you.
Sebastian Grueb 0 Reputation points

2024-09-18T08:41:39.8166667+00:00

Hi Kiran

we're heavily using PIM and distribute permissions on resource group level.

Usually resource group "Owner" is not even considered granted to us, which already causes a lot of limitations (and execptional approvals), but now we even need subscription-level access permissions to create Function Apps?

Also, the documentation states that "Contributor or Owner" is fine too.

Can you confirm this again?
Thanks!
Kiran P 8,255 Reputation points Microsoft External Staff Volunteer Moderator

2024-09-19T09:04:57.6033333+00:00

Hi Sebastian Grueb,

We would like to inform you that we are not equipped to handle access-related issues. Consequently, we recommend that you reach out to your IT team for the necessary assistance regarding this matter. They will be able to provide the appropriate support and guidance.
Sebastian Grueb 0 Reputation points

2024-09-19T09:14:20.0833333+00:00
Hi Kiran

it's clear that you're not defining our policies or the architecture we employ to organize our environment, but this is a very recent change on your side. Just 1-2 months ago, the "Contributor" role on resource groups was fully sufficient to create a "Function App", with system- or user-managed identities.

Also, the design we're implementing is not unique to our company. Having subscriptions that reflect the "environments" [prod, test, dev, playground], instead of grouping teams or applications is not unheard of.

What you could do here is

explain why "subscription ownership" is suddenly required, which would help us understand this better

check internally if this behavior change is really expected, or if it was "wrong" before (i.e. it should've never been possible to create a "Function App" in a RG with Contributor access?)

Thanks!

Sebastian
Kiran P 8,255 Reputation points Microsoft External Staff Volunteer Moderator

2024-09-19T10:11:04.3233333+00:00

Hi Sebastian Grueb,

Microsoft frequently updates its documentation to incorporate the latest changes and improve the user experience. In this context, the terminology has been revised from "contributor" to "account subscription level." For latest changes from the azure portal, it will take some time to reflect in the final documentation.

Thank you.
Durham, Zachary 5 Reputation points

2024-09-26T14:09:26.8666667+00:00

Sorry to threadjack, but we also have contributors at the resource group level who can no longer deploy function apps that are experiencing the same error. I cannot find what the new set of permissions should be, but I'm inclined to think something at the subscription level is too broad of a scope.
Sebastian Grueb 0 Reputation points

2024-09-26T14:26:36.96+00:00

I had to ask our cloud admins to setup the function apps for me in the end.

Deploying the actual logic and re-configuring the network etc. works with Owner/Contributor on Resource Group level [and probably on the resource directly too] as far as I can tell ... funnily, even the assignment of a "system managed identity" is something I could do, which I didn't expect after error message.
Kiran P 8,255 Reputation points Microsoft External Staff Volunteer Moderator

2024-09-26T18:33:38.5833333+00:00

Hi Durham, Zachary,

We have reached out to our internal team regarding this issue, and they are actively working on it.

Thank you for understanding.
Kiran P 8,255 Reputation points Microsoft External Staff Volunteer Moderator

2024-10-09T09:31:24.3666667+00:00

Hi Sebastian Grueb, Durham, Zachary,

We have reached out to the content author and got a confirmation saying that they had fixed the issue. Additionally to complete this exercise, you don't need an active subscription since it uses a default Sandbox. Activate the Sandbox and navigate to the Azure Portal, where you will see that you are logged in with the Sandbox directory, after login with the Microsoft Learn Sandbox directory, please follow the instructions given in the exercise.

Share via

Authorization Error

1 answer

Your answer