67

I was trying to invoke data factory pipeline from azure function programmatically. Its throwing following error.

link: http://eatcodelive.com/2016/02/24/starting-an-azure-data-factory-pipeline-from-c-net/

AuthorizationFailed: The client 'XXXX-XXXXX-XXXX' with object id 'XXX829e05'XXXX-XXXXX' does not have authorization to perform action 'Microsoft.DataFactory/datafactories/datapipelines/read' over scope '/subscriptions/XXXXXX-4bf5-84c6-3a352XXXXXX/resourcegroups/fffsrg/providers/Microsoft.DataFactory/datafactories/ADFTestFFFS/datapipelines/ADFTutorialPipelineCustom'.

tried to search similar issues, but none of the search result gave me solution to my problem, Can you please guide us what could be the issue?

Objective is to, run data factory pipeline whenever file being added to blob. so to achieve the result we are trying to invoke data factory pipeline from azure function using blob trigger.

Jeremy W
  • 1,889
  • 6
  • 29
  • 37
ravibhat
  • 811
  • 1
  • 7
  • 19

11 Answers11

95

Step 1: login to your azure portal
Step 2: find Subscriptions in left side menu bar and click.
enter image description here

step 3: Click on Access Control IAM and then click on Add.enter image description here

Step 4: In Add Permission window, select contributor for role. In select input box, type the app name you created in Azure AD (Created in Azure Active Directory)and select it. In my case I created Azure Resource Management.enter image description here

Step 5:After you have given successful permission, click on Refresh in your subscription window and you will see your app showing in the list. See below example. enter image description here

shebin c babu
  • 1,069
  • 8
  • 7
  • 3
    it should have been accepted as the correct answer. – Ben Oct 13 '19 at 19:26
  • 5
    "Azure Resource Management" is not a valid option to select from the list for me. – rollsch Jan 13 '20 at 05:31
  • 6
    @rolls You must read what author wrote "In select input box, type the app name you created in Azure AD (Created in Azure Active Directory)and select it. In my case I created Azure Resource Management." If you created "MyApp" you must type "MyApp" in the "select" field. – kayo Feb 24 '20 at 17:32
  • 1
    This is the right answer! I had been struggling with this for several hours and finally with this I was able to solve it. Thanks! – Nelson Rodriguez Apr 25 '20 at 00:16
  • 1
    Search on Azure Active Directory for the client GUID or object id present in the error message. This will give you the aplication you should select to assign access to on the Add Permission screen as shown in the answer prints. – Ulysses Alves Mar 16 '21 at 19:04
  • 2
    The best and accurate answer i found after struggling for 2 days. even MS did not mentioned these hacks /dependencies for such issues. Thanks Shebin. – Arvindvp6 Aug 08 '21 at 07:22
  • 1
    I was busy doing a course (https://learn.microsoft.com/en-us/learn/paths/build-serverless-full-stack-apps-azure/) and somehow the sandbox that I had run the scripts in displayed an incorrect resource group ID. I then logged in to portal.azure.com, but had to switch directory (Microsoft Learn Sandbox) to find the storage account under all resources. In there, I could find the correct resource group ID and was able to carry on with the course – Marius Van Der Berg Sep 07 '21 at 18:56
  • 4
    2021 this is still a valid answer to a very good headache. Someone please give this man a cookie! Nowhere does Microsoft mention the need for this! – FAB Oct 13 '21 at 13:58
  • Such an hero, that azure web interface its a real nightmare, it's not the first time i face the issue, and I anyway fell into it again for days – lese Dec 15 '21 at 14:29
  • 2023, still the right answer to the issue! Bravo! – Birtija Apr 26 '23 at 14:31
11

SEE Common problem when using Azure resource groups & RBAC https://blogs.msdn.microsoft.com/azure4fun/2016/10/20/common-problem-when-using-azure-resource-groups-rbac/

This issue is more likely to happen in newer subscriptions and usually happens if a certain resource type has never been created before in that subscription.

Subscription admins often fix this issue by granting resource group owners contributor rights on the subscription level which contradicts with their strategy of isolating access down to the level of resource group level not the subscription level.

Root cause

Some admins say, that some resources require access to the subscription level to be able to create these resources and that ‘owner’ rights on a resource group level is not sufficient. That is not true.

Let’s take a step back to understand how this all works first.

To provision any resources in azure (using the resource manager model) you need to have a resource provider that supports the creation of that resource. For example, if you will provision a virtual machine, you need to have a ‘Microsoft.Compute’ resource provider available in the subscription first before you can do that.

Resource providers are registered on the level of the subscription only.

Luckily, the Azure Resource Manager (ARM) is intelligent enough to figure that out for you. When a new Azure resource gets provisioned, if the resource provider required for that resource type is not registered in the subscription yet, ARM will attempt to register it for you. That action (resource provider registration) requires access to the subscription level.

By default, any new azure subscription will be pre-registered with a list of commonly used resource providers. The resource provider for IoTHub for instance, is not one of them.

When a user is granted owner rights only on a specific resource group, if that user tries to provision a resource that requires registering a resource provider for the first time, that operation will fail. That is what happened in our case above when trying to provision IoThub.

So the bottom line is, we DO NOT need to grant access permissions to the subscription level for users to be able to create resources like HDInsight, IotHub and SQLDW …etc within their resource groups that they have owner rights on, as long as the resource providers for these resources is already registered.

Michael Hunter
  • 111
  • 1
  • 2
8

You get the error that you are not authorized to perform action 'Microsoft.DataFactory/datafactories/datapipelines/read' over scope of pipeline because you don't have the relevant permissions on the datafactory.

You either need to have "Contributor" /"DataFactoryContributor" permissions to create & manage data factory resources or child resources. More details of the azure RBAC roles in the following link:

https://learn.microsoft.com/en-us/azure/active-directory/role-based-access-built-in-roles

Since the customer is trying to use the ADF client from inside Azure Function, the recommendation is to use AAD application and service principal for authentication of ADF client. You can find the instructions for creating AAD application and service principal here:

https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-group-authenticate-service-principal

Please follow the instructions on how to create the Active Directory application, service principal, and then assign it to the Data Factory Contributor role in the following link and the code sample for using service principal with ADF client.

SharmM
  • 89
  • 2
7

We recently had this issue with the same message and found that it was caused by the user being logged in with a different subscription (we have 2). Using az login --subscription resolved the problem for us.

Rob Targosz
  • 91
  • 1
  • 4
  • 1
    had the same problem because the default subscription was different from the one we wanted to use. The generation of the AAD app worked, but it gave authentication errors. Don't even know if it's possible to see this in the UI that it's assigned to the wrong one... – emp Apr 26 '19 at 10:06
6

For anyone else running into a similar issue with the same error message - After "az login" I was recieving the same error when attempting to create a resource group as Owner, I solved this with:

az account set --subscription "Azure Subscription 1"

Basically it stems from the subscription not being set, you can find the details here: https://learn.microsoft.com/en-us/cli/azure/manage-azure-subscriptions-azure-cli#get-the-active-subscription

Augz
  • 61
  • 1
  • 3
0

Solution:

  1. Step 1: Register an app in Azure Active directory.
  2. Step 2: Assign 'Data Factory Contributor' role to the same app. we can achieve this by using power shell.

The below code works for me. Please try out in power shell after logged in with Azure credential.
Implementation:

  1. Step 1: $azureAdApplication = New-AzureRmADApplication -DisplayName <AppName> -HomePage <URL> -IdentifierUris <URL with domain> -Password <Password>
  2. Step 2: New-AzureRmRoleAssignment -RoleDefinitionName "Data Factory Contributor" -ServicePrincipalName $azureAdApplication.ApplicationId
Harsha Biyani
  • 7,049
  • 9
  • 37
  • 61
Jeyachandran
  • 9
  • 1
0

Follow this post : https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal

In this post , Role is given as "Reader" which should be "Owner" instead otherwise it would give permission error on deployment.

Manish Kumar
  • 119
  • 1
  • 5
0

I solved by following this post: https://www.nwcadence.com/blog/resolving-authorizationfailed-2016 with the command in PowerShell:

Get-AzureRmResourceProvider -ListAvailable | Select-Object ProviderNamespace | Foreach-Object { Register-AzureRmResourceProvider -ProviderName $_.ProviderNamespace}
Stephen Rauch
  • 47,830
  • 31
  • 106
  • 135
geliz zhang
  • 1
0

i tried to solve the problem by adding roles as mentioned above (contributor , ADF contributor and Reader) to the subscription level and resource etc. but i kept on getting the error when i try to authenticate the access to my app, so i solved it by adding my app to the subscription level, i gave it the access of Reader.

Sally Dabbah
  • 411
  • 2
  • 8
0

I had a similar issue. I have access to different tenants and the default tenant it was picking was the wrong one. Solved this by logging into az using:

az login --tenant <tenantID>

After which I was able to successfully run the az ad sp create-for-rbac command.

Jeremy Caney
  • 7,102
  • 69
  • 48
  • 77
mariekumi
  • 1
  • 1
  • 1
    Thank you for your interest in contributing to the Stack Overflow community. This question already has quite a few answers—including one that has been extensively validated by the community. Are you certain your approach hasn’t been given previously? **If so, it would be useful to explain how your approach is different, under what circumstances your approach might be preferred, and/or why you think the previous answers aren’t sufficient.** Can you kindly [edit] your answer to offer an explanation? – Jeremy Caney Aug 17 '23 at 02:17
-4

I solved by finding the Enterprise Application > Object ID. (it is weird that it does not use App Reg > Application Id)

https://jeanpaul.cloud/2020/02/03/azure-data-factory-pipeline-execution-error/

Paul
  • 1