How to use MSAL Python library to create an Azure Activity log - azure

Question

I am trying to use MSAL Python library to create an alert in Azure Activity Log. Here is my code:
from azure.identity import ClientSecretCredential
from azure.mgmt.monitor import MonitorManagementClient
MSAL_CLIENT_ID = "<My Client Id>"
MSAL_CLIENT_SECRET = "<My Client Secret>"
TENANT_ID = "<My Tenant Id>"
credentials = ClientSecretCredential(
client_id = MSAL_CLIENT_ID,
client_secret = MSAL_CLIENT_SECRET,
tenant_id = TENANT_ID
)
SUBSCRIPTION_ID = "<My Subscription Id>"
monitor_client = MonitorManagementClient(
credential=credentials,
subscription_id=SUBSCRIPTION_ID
)
GROUP_NAME = "<My Resource Group Name>"
ACTIVITY_LOG_ALERT_NAME = "test"
log_alert = monitor_client.activity_log_alerts.create_or_update(
GROUP_NAME,
ACTIVITY_LOG_ALERT_NAME,
{
"location": "Global",
"scopes": [
"subscriptions/" + SUBSCRIPTION_ID
],
"enabled": True,
"condition": {
"all_of": [
{
"field": "category",
"equals": "Administrative"
},
{
"field": "level",
"equals": "Error"
}
]
},
"actions": {
"action_groups": [
]
},
"description": "Sample activity log alert description"
}
)
print("Create activity log alert:\n{}".format(log_alert))
But I got the following error
HttpResponseError Traceback (most recent call last)
~\AppData\Local\Temp\ipykernel_24988\3130136741.py in
----> 1 log_alert = monitor_client.activity_log_alerts.create_or_update(
2 GROUP_NAME,
3 ACTIVITY_LOG_ALERT_NAME,
4 {
5 "location": "Global",
C:\ProgramData\Anaconda3\envs\hlgdev\lib\site-packages\azure\core\tracing\decorator.py in wrapper_use_tracer(*args, **kwargs)
76 span_impl_type = settings.tracing_implementation()
77 if span_impl_type is None:
---> 78 return func(*args, **kwargs)
79
80 # Merge span is parameter is set, but only if no explicit parent are passed
C:\ProgramData\Anaconda3\envs\hlgdev\lib\site-packages\azure\mgmt\monitor\v2020_10_01\operations_activity_log_alerts_operations.py in create_or_update(self, resource_group_name, activity_log_alert_name, activity_log_alert_rule, **kwargs)
381 map_error(status_code=response.status_code, response=response, error_map=error_map)
382 error = self._deserialize.failsafe_deserialize(_models.ErrorResponse, pipeline_response)
--> 383 raise HttpResponseError(response=response, model=error, error_format=ARMErrorFormat)
384
385 if response.status_code == 200:
HttpResponseError: (AuthorizationFailed) The client '17abcd' with object id '17abcd' does not have authorization to perform action 'Microsoft.Insights/activityLogAlerts/write' over scope '/subscriptions/59abcd/resourceGroups/MyResource/providers/Microsoft.Insights/activityLogAlerts/test' or the scope is invalid. If access was recently granted, please refresh your credentials.
Code: AuthorizationFailed
Message: The client '17abcd'' with object id '17abcd'' does not have authorization to perform action 'Microsoft.Insights/activityLogAlerts/write' over scope '/subscriptions/59abcd/resourceGroups/MyResource/providers/Microsoft.Insights/activityLogAlerts/test' or the scope is invalid. If access was recently granted, please refresh your credentials.
Please help. Thank you very much!

Answer 1

I tried running the below code with a Service Principal with an Owner or Contributor role at the Subscription level the code ran successfully like below:-
Service Principal role at the subscription level :-
Now, I tried creating the same Activity log with another Service Principal without the Owner or contributor role but just the reader role. It failed with the same error code as yours:-
Output failed:-
I added the same service principal with a Contributor role scoped at the resource group level and the error was resolved:-
Output ran successfully:-
Make sure your app/service principal have at least Contributor or Owner role assigned at the Subscription or Resource Group Level in your Azure Subscription.