Lighouse access with Azure Portal not working, CLI works fine

Question

Hi

The Azure Portal fails with the following error message when accessing resources and resource groups for a subscription delegated with Azure Lighthouse:

An error occured when trying to fetch resources. Additional details from the underlying API that might be helpful: Please provide below info when asking for support: timestamp = 2020-08-05T08:26:44.2201451Z, correlationId = 3bb84301-a2dc-433e-b123-bd8d8601095c. (Code: AccessDenied) Access is denied to the requested resource. The user might not have enough permission. (Code: AccessDenied) You can try accessing your resources using Resource Explorer.

Subscription ID: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
Subscription tenant: M365x447456.onmicrosoft.com
UPN of user that tries to access: demo.requestor@m365x344290.onmicrosoft.com
Tenant ID of user that tries to access: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

ARM template deployed: https://raw.githubusercontent.com/Azure/Azure-Lighthouse-samples/master/templates/delegated-resource-management/delegatedResourceManagement.json
Parameters:

{
"contentVersion": "1.0.0.0",
"$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentParameters.json#",
"parameters": {
"mspOfferDescription": {
"value": "Provides delegated access to subscription"
},
"authorizations": {
"value": [
{
"roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c",
"principalId": "7644ff2a-1af8-4879-8081-95e311015090"
},
{
"roleDefinitionId": "acdd72a7-3385-48ef-bd42-f606fba81ae7",
"principalId": "3730b044-78a1-4d9c-90ef-b665d813fa93"
}
]
},
"mspOfferName": {
"value": "Lighthouse Delegation"
},
"managedByTenantId": {
"value": "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
}
}
}

What is very interesting is that the same user can use Azure CLI, and it works fine. "az group list" and "az storage account list" works just fine, so it is definitely a bug in the portal or something.

Marius

Answer 1

It seems this was only an issue for either demos.microsoft.com tenants or trial subscriptions. Worked for another tenant with a permanent sub.