Azure REST API - authentication error

Question

Hi there.

After creating an App in my account in Azure Active Directory, I create a client secret and call using Postman:

https://login.microsoftonline.com/{my-tenant}/oauth2/v2.0/token

I receive the token and use it as Authorization calling (Postman)

https://management.azure.com/subscriptions/{subscription-id}/resourceGroups/WEB/providers/Microsoft.Compute/virtualMachines/LP-vm1?api-version=2022-03-01&%24expand=instanceView

This call returns a "Authentication failed" error. What's wrong?

Answer 1

@Carlo Cecco
Thank you for following up on this and I apologize for the delayed response!

When it comes to the Request ID and Correlation ID that you shared, I wasn't able to find any logs from our end. However, to make sure you have everything set up correctly, and since you already have everything created/ downloaded in order to use Postman, can you reference my walk-through below and make sure you have the same or similar values.

#The majority of these values can be found on your Azure AD App Registration  
Tenant ID  
Client ID  
Client Secret Value  

#You'll be using `https://management.azure.com/.default` as the scope in order to get the AAD Token  
Scope: https://management.azure.com/.default  
Grant Type: client_credentials  
  
#To get the AAD Token, you'll be using the `/oauth2/token` endpoint  
POST https://login.microsoftonline.com/{tenantId}/oauth2/token  

#Once you have the Access Token, you'll copy and paste it into your Virtual Machines - Instance View HTTP Request.  
#Optionally you can verify the Access Token at https://jwt.ms/  
#For more info - https://learn.microsoft.com/en-us/rest/api/compute/virtual-machines/instance-view?tabs=HTTP  
Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsI......  

#From your initial HTTP Request it looks like you're trying to get the instance view, so you should be able to use the below GET request  
#For more info - https://learn.microsoft.com/en-us/rest/api/compute/virtual-machines/instance-view?tabs=HTTP  
https://management.azure.com/subscriptions/{{subscriptionId}}/resourceGroups/VirtualMachines/providers/Microsoft.Compute/virtualMachines/testVM/instanceview?api-version=2022-03-01  

Troubleshooting:
The client '...' with object id '...' does not have authorization to perform action 'Microsoft.Resources/subscriptions/WEB/Microsoft.Compute/LP-vm1/read' over scope '/subscriptions/.../WEB/providers/Microsoft.Compute/virtualMachines' or the scope is invalid

WWW-Authenticate: Bearer authorization_uri="https://login.windows.net/...ce11a3", error="invalid_token", error_description="Could not find identity for access token." x-ms-failure-cause: gateway

From the full error message that you shared, it looks like you might've been using https://login.windows.net/ as the scope, which could be the issue. However, if you're still running into the same error message after using https://management.azure.com/.default scope, please let me know.

You can also walk through the Azure REST APIs with Postman (2021) blog post, which details steps on how to get started with Postman to hopefully help resolve the authorization portion of your error message.

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Answer 2

@Carlo Cecco
Thank you for following up on this!

Error Message:
The client '...' with object id '...' does not have authorization to perform action 'Microsoft.Resources/subscriptions/WEB/Microsoft.Compute/LP-vm1/read' over scope '/subscriptions/.../WEB/providers/Microsoft.Compute/virtualMachines' or the scope is invalid

From your error message, and based off the Virtual Machines - Get documentation, it looks like you'll need to add the user_impersonation API permisson to your app. If you're still running into the same issue, you'll have to make sure that the user you're logged in with/impersonating has the correct RBAC (read) permissions under the /subscriptions/.../WEB/providers/Microsoft.Compute/virtualMachines scope.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.