Cannot obtain permission to edit container App

Question

Cannot obtain permission to edit container App

Facundo Sosa-Rey 0

My administrator has given me all the roles that seem remotely relevant to editing Container Apps, such as

Container Apps ConnectedEnvironments Contributor

Container Apps Contributor

Container Apps ManagedEnvironments Contributor

Container Apps Operator

Container Registry Repository Catalog Lister

Container Registry Repository Writer

Reader

Regardless, when I try to "Edit and deploy" a container, I get the following error:

`The client

Sai Prabhu Naveen Parimi 730 Reputation points Microsoft External Staff

2025-02-07T23:22:11.57+00:00

Facundo Sosa-Rey

Welcome to Microsoft Q&A Platform!

Thank you for reaching out. To better assist you with the issue you're experiencing, could you please provide the complete error message you encountered when trying to "Edit and deploy" a container? Having the full error message will help us understand the problem more clearly and offer accurate troubleshooting steps.
Sai Prabhu Naveen Parimi 730 Reputation points Microsoft External Staff

2025-02-11T20:18:27.69+00:00
Facundo Sosa-Rey

I wanted to follow up on your issue with the "Edit and deploy" process. Were you able to gather the complete error message? If you’re still experiencing the problem, please share any additional details, such as:

The exact error message you received

The steps you followed before encountering the issue

Any recent changes to your environment or configuration

This information will help us troubleshoot more effectively and provide the best possible solution. Looking forward to your response!
Facundo Sosa-Rey 0 Reputation points

2025-02-13T13:51:23.4466667+00:00

Sorry the message got truncated:

The client '******@anyonsys.com' with object id '6764a3b4-0c48-4b23-9bdd-d4e62af3c3f6' does not have authorization to perform action 'Microsoft.ContainerRegistry/registries/listCredentials/action' over scope '/subscriptions/7e0adb77-2026-4e91-84eb-99bd94f80983/resourceGroups/rg-thunderhead/providers/Microsoft.ContainerRegistry/registries/thunderhead' or the scope is invalid. If access was recently granted, please refresh your credentials.
Facundo Sosa-Rey 0 Reputation points

2025-02-13T17:01:35.7566667+00:00

I happens whenever I go to "Application" -> "Containers" -> "Edit and deploy" -> select a container image -> error thrown when the edit pane comes up
Facundo Sosa-Rey 0 Reputation points

2025-02-14T18:15:14.5833333+00:00

Sai Prabhu Naveen Parimi
Sai Prabhu Naveen Parimi 730 Reputation points Microsoft External Staff

2025-02-15T00:26:14.7433333+00:00
Facundo Sosa-Rey

It appears you're facing an authorization issue when attempting to "Edit and deploy" a container in Azure. The error message indicates that the client lacks the necessary permissions to perform the action Microsoft.ContainerRegistry/registries/listCredentials/action over the specified scope.

Here are a few steps you can take to resolve this issue:

Verify Role Assignments: Ensure that your account's roles include the required permissions for the Microsoft.ContainerRegistry/registries/listCredentials/action. The roles you mentioned should generally cover most of the required permissions, but you might need to check if any additional roles or custom roles are needed.

Refresh Credentials: If access was recently granted, try refreshing your credentials by signing out and signing back into the Azure portal or using the Azure CLI to refresh your token.

Review Documentation: Refer to the Azure documentation on role-based access control (RBAC) for containers to ensure all necessary permissions are covered. This can help you identify any missing permissions or misconfigurations. https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/containers#microsoftcontainerregistry

If the issue persists, please provide more details about the steps you followed and any recent changes to your environment or configuration. This will help in troubleshooting the problem more effectively.
Facundo Sosa-Rey 0 Reputation points

2025-02-17T17:27:04.3833333+00:00

@Sai Prabhu Naveen Parimi

Yes I have gone through the documentation, and I cant get anywhere. It seems to me all the roles that are required to perform the Microsoft.ContainerRegistry/registries/listCredentials/action are already granted. I have done the easy things like signin out, like 7 times.

1 answer

Your answer

Sai Prabhu Naveen Parimi 730 Reputation points Microsoft External Staff

2025-02-07T23:22:11.57+00:00

Facundo Sosa-Rey

Welcome to Microsoft Q&A Platform!

Thank you for reaching out. To better assist you with the issue you're experiencing, could you please provide the complete error message you encountered when trying to "Edit and deploy" a container? Having the full error message will help us understand the problem more clearly and offer accurate troubleshooting steps.
Sai Prabhu Naveen Parimi 730 Reputation points Microsoft External Staff

2025-02-11T20:18:27.69+00:00

Facundo Sosa-Rey

I wanted to follow up on your issue with the "Edit and deploy" process. Were you able to gather the complete error message? If you’re still experiencing the problem, please share any additional details, such as:

The exact error message you received

The steps you followed before encountering the issue

Any recent changes to your environment or configuration

This information will help us troubleshoot more effectively and provide the best possible solution. Looking forward to your response!
Facundo Sosa-Rey 0 Reputation points

2025-02-13T13:51:23.4466667+00:00

Sorry the message got truncated:

The client '******@anyonsys.com' with object id '6764a3b4-0c48-4b23-9bdd-d4e62af3c3f6' does not have authorization to perform action 'Microsoft.ContainerRegistry/registries/listCredentials/action' over scope '/subscriptions/7e0adb77-2026-4e91-84eb-99bd94f80983/resourceGroups/rg-thunderhead/providers/Microsoft.ContainerRegistry/registries/thunderhead' or the scope is invalid. If access was recently granted, please refresh your credentials.
Facundo Sosa-Rey 0 Reputation points

2025-02-13T17:01:35.7566667+00:00

I happens whenever I go to "Application" -> "Containers" -> "Edit and deploy" -> select a container image -> error thrown when the edit pane comes up
Facundo Sosa-Rey 0 Reputation points

2025-02-14T18:15:14.5833333+00:00

Sai Prabhu Naveen Parimi
Sai Prabhu Naveen Parimi 730 Reputation points Microsoft External Staff

2025-02-15T00:26:14.7433333+00:00

Facundo Sosa-Rey

It appears you're facing an authorization issue when attempting to "Edit and deploy" a container in Azure. The error message indicates that the client lacks the necessary permissions to perform the action Microsoft.ContainerRegistry/registries/listCredentials/action over the specified scope.

Here are a few steps you can take to resolve this issue:

Verify Role Assignments: Ensure that your account's roles include the required permissions for the Microsoft.ContainerRegistry/registries/listCredentials/action. The roles you mentioned should generally cover most of the required permissions, but you might need to check if any additional roles or custom roles are needed.

Refresh Credentials: If access was recently granted, try refreshing your credentials by signing out and signing back into the Azure portal or using the Azure CLI to refresh your token.

Review Documentation: Refer to the Azure documentation on role-based access control (RBAC) for containers to ensure all necessary permissions are covered. This can help you identify any missing permissions or misconfigurations. https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/containers#microsoftcontainerregistry

If the issue persists, please provide more details about the steps you followed and any recent changes to your environment or configuration. This will help in troubleshooting the problem more effectively.
Facundo Sosa-Rey 0 Reputation points

2025-02-17T17:27:04.3833333+00:00

@Sai Prabhu Naveen Parimi

Yes I have gone through the documentation, and I cant get anywhere. It seems to me all the roles that are required to perform the Microsoft.ContainerRegistry/registries/listCredentials/action are already granted. I have done the easy things like signin out, like 7 times.

Answer 1

Sam Cogan 10,802 MVP

The issue you are having is not permissions on the container app, it is permissions on the container registry you are trying to pull the image from. This error:

The client '******@anyonsys.com' with object id '6764a3b4-0c48-4b23-9bdd-d4e62af3c3f6' does not have authorization to perform action 'Microsoft.ContainerRegistry/registries/listCredentials/action' over scope '/subscriptions/7e0adb77-2026-4e91-84eb-99bd94f80983/resourceGroups/rg-thunderhead/providers/Microsoft.ContainerRegistry/registries/thunderhead' or the scope is invalid. If access was recently granted, please refresh your credentials.

States that you do not have permission to get credentials to access the container registry called "thunderhead"

Facundo Sosa-Rey 0 Reputation points

2025-02-17T18:07:16.4566667+00:00

@Sam Cogan

When I look at the "thunderhead" container registry, the access control shows me all the permissions I listed above: those permissions we granted at the ressource group level

Share via

Cannot obtain permission to edit container App

1 answer

Your answer