Getting does not have authorization to perform action or scope is invalid.

Kalyani Wani 80

We're getting the following error 'The client 'f774a339-7628-49ff-9829-49c522b6d49c' with object id 'f774a339-7628-49ff-9829-49c522b6d49c' does not have the authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/read' over scope '/subscriptions/3535caf0-dd76-4e49-8666-cdbb6f15aa55' or the scope is invalid. If access was recently granted, please refresh your credentials.' We've already given a Contributor role and added a few custom roles such as:

1.'Microsoft.Authorization//write', 2.'Microsoft.Authorization//read', 3.'Microsoft.Resources/subscriptions/', 4.'Microsoft.Resources/subscriptions/resourceGroups/', 5.'Microsoft.Resources/subscriptions/resourcegroups/resources/', 6.'Microsoft.Resources/subscriptions/resources/', 7.'Microsoft.Resources/subscriptions/locations/*'

Still facing the same issue.

Andy David - MVP 149.7K Reputation points MVP

2023-01-24T12:34:48.35+00:00

If you go the subscription and Access Control (IAM ), "Check Access" , what does is show for access for that security principal you gave the permissions to?
Kalyani Wani 80 Reputation points

2023-01-24T12:47:13.46+00:00

I gave permissions to specific user, by selecting User,Group and service principal.
Andy David - MVP 149.7K Reputation points MVP

2023-01-24T12:50:07.85+00:00

Hi, can you verify what access it has in the subscription?

[https://learn.microsoft.com/en-us/azure/role-based-access-control/check-access#step-2-check-access-for-a-user
Kalyani Wani 80 Reputation points

2023-01-24T13:32:41.4966667+00:00

I've provided Contributor role to the user, as shown in the image.
Also I've created custom roles, as mentioned in above message.
tg-5656 10 Reputation points

2023-09-01T08:04:49.6233333+00:00

In my case the search process not find my profile.
Yinka Idowu 5 Reputation points Microsoft Employee

2024-07-24T20:55:40.52+00:00

In addition, make sure you have the right subscription context within your tenant. You can confirm and ensure the subscription is indeed the correct one from the overview page of the SQL server resource in Azure portal. Run the command below to set your context.

Set-AzContext -Subscription 3535caf0-dd76-4e49-8666-cdbb6f15aa55
joseville 0 Reputation points Microsoft Employee

2024-09-17T20:55:35.5533333+00:00

Setting the subscription in the context was what finally worked for me.

az account set --subscription "<subId>" if using Bash, otherwise see Yinka Idowu's 7/24/24 comment if using PowerShell: Set-AzContext -Subscription <subId>

4 answers

Akshay-MSFT 17,881 Reputation points Microsoft Employee

2023-03-21T11:18:34.61+00:00

@Kalyani Wani

The error is not related to the user but to the application. Kindly look for application/SPN name with client ID: 'f774a339-7628-49ff-9829-49c522b6d49c.

Navigate to the subscription > Choose the subscription > Add Role assignment > Reader > assign to the application SPN:

Thanks,

Akshay Kaushik
Please sign in to rate this answer.

10 people found this answer helpful.
Admin iSS 0 Reputation points

2023-10-31T01:44:35.4+00:00

Kudos! Worked like a charm!

Akshay-MSFT 17,881 Reputation points Microsoft Employee

2023-10-31T04:18:13.8+00:00

@Kalyani Wani

Thank you for taking time to share your feedback.

Since we were able to clarify the response in the above answer, I request that you would "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Thanks,

Akshay Kaushik

Muhammad Rahman 1 Reputation point

2024-01-24T02:00:28.15+00:00

I think I'm having the same issue even though I am using Azure Global Admin user in my subscription. Using the same user, I never had this issue before. Now, I even cannot edit/create/delete any resources in my subscription.
I attached my user roles in the following screenshot:

Any idea?
Thanks

manas 0 Reputation points

2024-09-03T14:47:22.27+00:00

This works. Just assign the service principal the role of reader and the api call works like a charm.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
TWA 20 Reputation points

2024-02-14T10:56:04.32+00:00

make sure you are in the right subscription. after you login with "Connect-AzAccount" go to "Select-AzSubscription -SubscriptionName 'X'
Please sign in to rate this answer.

4 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Phạm Như Long 5 Reputation points

2024-11-24T04:54:42.8566667+00:00

I am experiencing the same issue as mentioned above. I am the owner of the project, but I don’t understand why I don’t have any permissions to remove in deny assignment and I also don't have permission to add new role too.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Rohan Krishna Ullas 5 Reputation points Microsoft Employee

2024-03-11T11:00:33.9166667+00:00

Following the steps here helped me "https://learn.microsoft.com/en-us/azure/cosmos-db/managed-identity-based-authentication?tryIt=true&source=docs#code-try-1". I had to add a custom role from Azure Command shell to get access
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.