Create an Azure Resource Manager connection - Failed to set Azure Permission

Question

Hi everybody,

I have an error from my colleague that he's trying to create an ARM connection. We are project administrators on this project. I can create the connection, but he doesn't create the same connection.

Also, the error mentions to resolve this issue, the user has 'Owner' or 'User Access Administrator' permissions on the subscription, this kind of permissions I have. I want to know if this is the only way to resolve this issue or if I can give him some permissions to resolve this issue.

I appreciate your experience on the comments, thanks.

Best Regards,

Answer 1

Hi Antonny García

The Contributor role allows your colleague to manage resources but doesn’t grant permission to assign roles to others. On the other hand, User Access Administrator enables them to manage access permissions.

Since your colleague needs permissions to create the ARM service connection, having User Access Administrator should be sufficient.

Please Let me know if you have any queries.

If you found the information helpful, please click "Upvote" on the post to let us know and consider accepting the answer as the token of appreciation. Thank You.

Answer 2

Hi Antonny García

Since the error states that 'Owner' or 'User Access Administrator' permissions are required, this suggests that your colleague may not have sufficient access at the subscription level.

Go to Azure Portal -> Subscriptions -> Access Control (IAM) -> Roles -> Search for your colleague’s name -> To add roles, click on Add Role Assignment-> Choose either Owner, User Access Administrator, Contributor.

After updating permissions, wait for few minutes and then ask your colleague to try creating the ARM connection again.

Additional References:

https://learn.microsoft.com/en-us/azure/devops/pipelines/release/azure-rm-endpoint?view=azure-devops

Hope this helps!

Please Let me know if you have any queries. If you found the information helpful, please click "Upvote" on the post to let us know and consider accepting the answer as the token of appreciation. Thank You.

Answer 3

You could try setting up a user-assigned managed identity, or Service Principal, then grant that permission to Azure, then when setting up the Service Principal, try Manual, and enter in the application ID and secret, and try that. If that doesn't work, then it may be relevant for you to set up the connection and allow its use on the Project, then he can use it.

Answer 4

Hi Durga Reshma Malthi,

I followed the steps that you mentioned, now I'm waiting for the confirmation from my colleague. Regarding your instructions, I'd like to ask you if there is any issue now my colleague has two roles: Contributor and User Access Administrator, or he should have a role only?

Thanks for your support!