How to resolve the "Forbidden" Error issue while creating the Service Connection in Azure DevOps

Question

In the Azure DevOps, I am trying to create an service connection in the project. We have an dedicated app registration and it's client secret.

The Steps I have followed are :

Identity type : App registration or managed identity (manual)

Credential : Secret

Environment: Azure Cloud

Scope Level : Subscription

Provided these details: Subscription ID, Subscription name, Application (client ID), Directory (tenant) ID, Client Secret.
While verifying the Client secret, getting error as follows :

Failed to query service connection API: 'https://management.azure.com/subscriptions/681e5bae-0abhabdjsa-asdjbdjA-ee?api-version=2016-06-01'. Status Code: 'Forbidden', Response from server: '{"error":{"code":"AuthorizationFailed","message":"The client 'c9dc1639-98YT-2E43-b096-bc1a388e731b' with object id '01145240-023v-975y-8871-23849ni2h34' does not have authorization to perform action 'Microsoft.Resources/subscriptions/read' over scope '/subscriptions/681e5bae-0abhabdjsa-asdjbdjA-ee' or the scope is invalid. If access was recently granted, please refresh your credentials."}}'

Need Assistance in resolving the issue

Answer 1

Hello Sai kiran Bonthu,

Thank you for reaching out to Microsoft Q&A.

From the Error message you posted in your query, it shows that your Service Principal does not have at least Reader role assigned at the subscription level.

Even I faced the same error, When I tried creating Service connection without adding at least Reader role to the Service Principal, Refer below:

To resolve this Error, please add the Reader role to the Service Principal like below:

Visit your Subscription > Access Control (IAM) > Add Role Assignment > Select Reader role > In Members > Select your Service principal.

Assign access to – User, Group, Service Principal> In Members Select your Service Principal > Click on Next > Review and Assign > After the role is assigned try creating the Service Connection again.

Refer below: -

Note- Make sure you add the Reader role in the subscription which you will add while creating the Service Connection.

After the role is added, try creating/verifying the Service Connection and it will be created successfully like below:

Visit your Azure DevOps Project Settings > Service Connection > New Service Connection > Azure Resource Manager > Identity Type: App registration or managed identity (manual) > Credential: Secret > Scope Subscription> Add the Subscription ID and Subscription Name of the Subscription where your Service principal has Reader role assigned > Add your Client ID, Tenant ID and Client Secret > Click on Verify > once it shows Verification Succeeded > Click on Verify and Save > The Service Connection will be created like below: