'Microsoft.Network/networkManagers/networkGroups/join/action' permission

Question

When I try to create a policy on an Azure policy on a Network Manager managed group, I get the following error (both in bicep code and also when using the Azure UI). Anybody has run into this? Specifically is 'Microsoft.Network/networkManagers/networkGroups/join/action' some new permission? I am an admin at the subscription and I'm still getting this error. Any help is appreciated!

'The client with object id '*

Answer 1

Hi Garsha Rostami

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

To successfully create and assign policies that involve network groups in Azure, the following permissions are required:
https://learn.microsoft.com/en-us/azure/templates/microsoft.authorization/policyassignments?pivots=deployment-language-bicep

https://learn.microsoft.com/en-us/azure/templates/microsoft.authorization/policydefinitions?pivots=deployment-language-bicep

You need the Microsoft.Network/networkManagers/networkGroups/join/action permission on the target network group in your policy. This permission allows you to add resources to that network group.

Network Contributor: Grants permissions to manage network resources, including network groups.

Resource Policy Contributor: Allows management of policy definitions and assignments.

If you have any further queries, do let us know.

---

If the answer is helpful, please click "Accept Answer" and "Upvote it".