Deleting Azure SWA named environment getting AuthorizationFailed but removes.

Per Kortbek Jørgensen 5

I am have a pipeline, were we are running some security scanning.

We first deploy the site to SWA named environments, then run the scan and removes the site (Using 'az staticwebapp environment delete').

It removes the site, but the task returns following:

ERROR: (AuthorizationFailed) The client 'xxxxxx' with object id 'xxxxxx' does not have authorization to perform action 'Microsoft.Web/locations/operationResults/read' over scope '/subscriptions/***/providers/Microsoft.Web/locations/westeurope/operationResults/xxxxx' or the scope is invalid. If access was recently granted, please refresh your credentials.

Code: AuthorizationFailed

ajkuma 28,036 Reputation points Microsoft Employee

2024-07-09T13:42:16.8233333+00:00

Firstly, apologies for the delayed response.

I understand you’re encountering an “AuthorizationFailed” error when deleting an Azure Static Web Apps (SWA) named environment, however the site is removed.

Typically, the error message indicates that the client lacks authorization to perform the specified action over a particular scope.

You may review that the service principal or user account you’re using has the necessary permissions to delete the named environment. Specifically, verify that it has the required permissions for the Microsoft.Web/locations/operationResults/read action.

If you’re using a service principal, consider regenerating its credentials or obtaining a new access token.

Just to highlight the specific diff in cmdlets:

az staticwebapp environment delete -Delete the static app production environment or the specified environment.

az staticwebapp delete - Delete a static app.

Kindly let us know, I'll follow-up with you further.
ajkuma 28,036 Reputation points Microsoft Employee

2024-07-10T15:43:07.12+00:00

Per Kortbek Jørgensen, Just checking in to see if you had got a chance to see the previous response. If the answer helped (pointed you in the right direction) > please click Accept Answer Or please share the requested/more info to help you better.
Per Kortbek Jørgensen 5 Reputation points

2024-07-29T07:12:39.9566667+00:00

As you also describe, the site is remove but i am still getting the "AuthorizationFailed".

So the commands remove the site but return an error, which seems that it will allow all to remove any disregarding security.
ajkuma 28,036 Reputation points Microsoft Employee

2024-07-29T07:51:24.7333333+00:00

Per Kortbek Jørgensen, Thanks for the follow-up. I was seeking to better understand your scenario/issue by just rephrasing your description of your question.

You had mentioned that "Deleting Azure SWA named environment getting AuthorizationFailed but removes." and "It removes the site*, but the task returns following:"*

Could you please provide more details about your scenario?
Are you an admin on the subscription?
Could you please share your webapp name here (if it's fine)?

Based on my understanding of your description, it's possible that the error message is misleading, I'll relay this feedback to our product engineering team.

You have mentioned about using the cmdlet az staticwebapp environment delete?

To clarify, az staticwebapp environment delete -Deletes the static app production environment or the specified environment where as (Vs) az staticwebapp delete - Deletes a static app.
Per Kortbek Jørgensen 5 Reputation points

2024-07-29T13:20:26.69+00:00
We are using "AzureCLI@2" task with a service connection attached through the azureSubscription option, running:

az staticwebapp environment delete

I am not a Admin on the subscription.
Webapp: app-web-corp
ajkuma 28,036 Reputation points Microsoft Employee

2024-07-30T18:11:54.1033333+00:00

Thanks for sharing the details. I have followed with you further privately.
Rian 0 Reputation points

2024-07-31T23:06:04.1733333+00:00

But but... I also want to know the answer to that. What role/permission needs to be assigned to a service principal to allow a CLI az staticwebapp environment delete command to succeed?
ajkuma 28,036 Reputation points Microsoft Employee

2024-08-01T17:56:09.22+00:00

Typically, you need to assign the Contributor role to the service principal for the resource group containing the static web app.

https://learn.microsoft.com/cli/azure/staticwebapp?view=azure-cli-latest
https://learn.microsoft.com/cli/azure/staticwebapp/environment?view=azure-cli-latest
Alessandro Bigi 0 Reputation points

2025-02-20T16:44:35.9733333+00:00

Actually, that's currently no longer accurate. Just recently we started to experience the same behavior in our ADO pipeline:

The client 'XYZ with object id 'ABC' does not have authorization to perform action 'Microsoft.Web/locations/operationResults/read' over scope '/subscriptions/D-E-F/providers/Microsoft.Web/locations/westeurope/operationResults/G-H-J' or the scope is invalid

To be noted the service principal used by our pipeline has always been a Contributor at the resource group level.

After some interpretation of the error message, we figured we had to assign the action Microsoft.Web/locations/operationResults/read at the Subscription level, as the scope which is required is not rooted at the Resource Group level (which raises a huge security red flag in my view).

We opted to assign the service principal Reader role at the Sub level, as we didn't have specific security concerns in this case. However, I believe a custom role would be possibly the best option until this behavior is fixed (IMO, it requires a fix).

Hope this helps

Share via

Deleting Azure SWA named environment getting AuthorizationFailed but removes.

Your answer