How to know which permission is missing when I get an error trying to perform an operation with an Azure Managed App VM?

Question

We offer a Managed App through the Azure Marketplace. We want our customers to be able to interactively manage Windows Updates and Backups on the VM deployed when they create an instance of the Managed App.

When the customer tries to perform operations on a Managed App VM, they get errors similar to:

• "The client '...' with object id '...' has permission to perform action 'Microsoft.RecoveryServices/locations/checkNameAvailability/action' on scope '/subscriptions/.../resourceGroups/.../providers/Microsoft.RecoveryServices/locations/eastus'; however, the access is denied because of the deny assignment with name 'System deny assignment created by managed application /subscriptions/.../resourceGroups/.../providers/Microsoft.Solutions/applications/...' and Id '2d54a703aca84e06a778b611a220139c' at scope '/subscriptions/.../resourceGroups/...'.

We can add Custom Allowed Actions to the Technical Configuration when configuring the Managed App offering, but how do we know which permission(s) to include there? There are literally thousands of defined permissions.

Answer 1

Hi Ken Collins,

Welcome to Microsoft Q&A Forum, thank you for posting your query here!

Since your customer tried performing operations on a Managed App VM, usually the customers can be denied accessing the resource because of the deny assignment which has assigned default while creating the managed application.

Please refer to the below mentioned different permission scenarios available based on publisher and customer needs for a managed application.

https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/overview#publisher-and-customer-permissions

Usually, the Customer access to the managed resource group is restricted by a deny assignment due to the "Publisher managed" permission, because it is the default permission for the managed application.

So, if you want your customer to have full management access to the managed resource group, you can choose Customer managed permission. There's no deny assignment with this permission. however, the publisher's access will be removed for the managed resource group. So as clearly mentioned over the article choose which permission can be suited for your environment.

Whereas, you can use azure policy definition also to get access for the associated resources to a managed application.

here is the built-in policy definitions for Azure Managed Applications.

https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/policy-reference

To enhance this, first you need to understand the below three parameters which can be referred over the policy as shown in below 2nd snippet. Then create a policy assignment and assign the deploy associations for a managed application policy.

After the policy is assigned successfully, the policy identifies noncompliant resources and deploy associations for those resources.

You can refer to the below article for better understanding.

https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/concepts-built-in-policy#built-in-policy-to-deploy-associations

This way you can have your customers to perform operations on the specified resources.

Hope this helps!

Please reply if you there are any challenges.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Thanks