Deploying SQL Server with High Availability fails due to access denied error

Question

I'm having trouble deploying SQL Server with High Availability from the Azure Marketplace. VMs and storage deploy successfully, but it fails on the Create new or update existing availability group listener step with the AccessDenied error seen below:

"statusMessage": "{\"status\":\"Failed\",\"error\":{\"code\":\"ResourceOperationFailure\",\"message\":\"The resource operation completed with terminal provisioning state 'Failed'.\",\"details\":[{\"code\":\"AccessDenied\",\"message\":\"Access denied for resource '/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-test/providers/Microsoft.Network/networkInterfaces/vmsqlcluster-2-ni'.\"}]}}",

I have owner access to the subscription and confirmed there are no deny RBAC entries or locks on the resource. Can anyone suggest how to solve this issue?

Answer 1

Hi Stu,

It looks like you are facing problems with the deployments from marketplace, here are a few suggestions that might help:

• Check the permissions: Even though you have owner access to the subscription, there might be some specific permissions required for the network interface that are not included in your role. You could try assigning yourself the Network Contributor role at the subscription or resource group level and see if that resolves the issue.
• Check for conflicting resources: There might be another resource with the same name that is causing a conflict. Maybe from former deployments if you were trying on several times.
• Check the service endpoints: If you’re trying to connect to your Azure SQL Database, make sure that the service you’re trying to connect from is allowed to access your Azure SQL Database.
• Troubleshoot the deployment: You can check the event logs to see if anything is preventing the installation.

If none of these suggestions work you can try deploying the cluster by yourself from a quick start template like: https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/availability-group-quickstart-template-configure?view=azuresql

Additional references:

• https://learn.microsoft.com/en-us/azure/azure-sql/database/high-availability-disaster-recovery-checklist?view=azuresql
• https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/availability-group-azure-portal-configure?view=azuresql&tabs=azure-cli
• https://azure.microsoft.com/en-us/blog/automate-always-on-availability-group-deployments-with-sql-virtual-machine-resource-provider/

If the information helped address your question, please Accept the answer.

Luis

Answer 2

@Stu Thank you for reaching out.

Seems like you are getting an access denied error message when trying to update an existing high availability group listener in SQL server.

As an owner of the subscription, you should have the necessary permissions to modify an existing availability group listener.

To create the first availability group listener of an availability group, we strongly recommend that you use SQL Server Management Studio, Transact-SQL, or SQL Server PowerShell. Avoid creating a listener directly in the WSFC cluster except when necessary, for example, to create an additional listener.

https://learn.microsoft.com/en-us/sql/database-engine/availability-groups/windows/create-or-configure-an-availability-group-listener-sql-server?view=sql-server-ver16