3

I have a service principal that is used by VSTS to run an Azure Powershell script. The command i'm trying to call is Get-AzureRmRoleAssignment. I'm getting the following error message

  "Exception": {
     "Request": {
       "Method": "POST",
       "RequestUri": "https://graph.windows.net/********/getObjectsByObjectIds?api-version=1.6",
       "Properties": "System.Collections.Generic.Dictionary`2[System.String,System.Object]",
       "Headers": "System.Collections.Generic.Dictionary`2[System.String,System.Collections.Generic.IEnumerable`1[System.String]]"
     },
     "Response": {
       "StatusCode": 403,
       "ReasonPhrase": "Forbidden",
       "Content": {
         "odata.error": {
           "code": "Authorization_RequestDenied",
           "message": {
             "lang": "en",
             "value": "Insufficient privileges to complete the operation."
           }
         }
       },
       "Headers": "System.Collections.Generic.Dictionary`2[System.String,System.Collections.Generic.IEnumerable`1[System.String]]"
}
}

I've verified that the service principal has read access for role assignment.

user9360564
  • 355
  • 1
  • 4
  • 13

1 Answers1

1

Actually, this powershell script Get-AzureRmRoleAssignment doesn't only needs read access for role assignment with Azure REST API permission but also needs Read directory data permission with Azure AD Graph API.

We can use Fiddler to find out which API does this command calls:

enter image description here

It means that Get-AzureRmRoleAssignment needs call 3 APIs to complete the operation. Two of them are Azure REST API, one of them is Azure AD Graph API:

POST https://graph.windows.net/<tenantID>/getObjectsByObjectIds?api-version=1.6

Solution:

So, check if your sp has permissions to read directory data permission.(You'd better add Read directory data permission both Application permissions and Delegated permissions and then click Grant permissions button). Here is my test result: enter image description here

Hope this helps!

Wayne Yang
  • 9,016
  • 2
  • 20
  • 40
  • Hi,@user9360564 Does this answer helpful? – Wayne Yang Apr 07 '18 at 15:01
  • 1
    This makes sense but the issue doesn't exist when i use a runbook in an automation account. The runbook uses a service principal and has the exact same permissions. I don't believe the module versions are the same but how would this change anything? – user9360564 Apr 09 '18 at 13:22
  • Hi,@user9360564. Maybe one has been granted permissions, the other one hasn't. So, you'd better add the permissions and also click the Grant permssions button. – Wayne Yang Apr 10 '18 at 05:02