While trying to enable VNET flow logs , encountering authorization failure, where the object ID mentioned in the logs is not associated with any resource

Question

While trying to enable VNET flow logs, encountering authorization failure, where the object ID mentioned in the logs is not associated with any resource.

The VNET and the storage account are in different subscriptions in the same region.

In the documentation, could not find any specific access requirement

Answer 1

Hello Anushree N

It looks like you're facing an authorization failure when trying to enable VNET flow logs, especially since the object ID mentioned isn't linked to any resource.

Since the VNET and the storage account are in different subscriptions, this might be causing the issue. Azure typically requires permissions that span multiple subscriptions, so you'll want to make sure that the necessary access is set up.

Here are a few things to check and consider:

1.Resource Provider Registration: The Microsoft.Insights resource provider must be registered in the subscription containing the VNet. This provider enables Network Watcher to create and manage flow logs.

Action: Check and register the provider:

• In the Azure portal, navigate to Subscriptions > [Your Subscription] > Resource providers.
• Search for Microsoft.Insights and ensure its status is Registered. If not, select it and click Register.

Refer: https://learn.microsoft.com/en-us/azure/network-watcher/vnet-flow-logs-manage?tabs=portal

2.Role Assignments: Verify that the user or service principal has appropriate permissions in both subscriptions. The user should ideally have roles like Network Contributor in the VNET subscription and Storage Account Contributor or higher in the storage account subscription.

3.Audit Logs: Check the Azure Activity Logs in both subscriptions. They can provide more insight into why the authorization is failing. Look specifically for any LinkedAuthorizationFailed error entries.

4.Ensure both subscriptions are under the same Microsoft Entra (Azure AD) tenant. Cross-subscription access for flow logs is only supported within the same tenant.

After validating the above details and retry enabling flow logs.

---

I hope this helps! Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

 If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!