I have a Azure For Student subscription through my university and I'm trying to work out how to deploy an Angular app to an Azure App Service using Azure Pipelines.
In my Release pipelines, in the step to deploy to an Azure App Service, I have to select a subscription. When I click Authorize I get the below error.
Seems I can't create a service connection because it requires access to Active Directory. I'm on my university's tenant so I don't have access to it.
Is there a way around this I can use Azure Pipelines if I don't have access to create accounts in Active Directory?
As the error explicityly says, There's no way to deploy this without being a Global Admin or Owner on the Azure Active Directory tenant.
Insufficient privileges to complete the operation.Ensure that the user
has permission to create an Azure Active Directory application.
This typically occurs when the system attempts to create an application in Azure AD on your behalf and this is a permission issue that may be due to the following causes:
The user has only guest permission in the directory
The user is not authorized to add applications in the directory
(1) If you only have guest permission in AAD ,please contact the admin to grant the minimum additional permissions to you. Let the admin to set Guest user permissions are limited to No.
(2) If you are the member of AAD, and just not be authorized to add applications in the directory. Go User settings, then change Users can register applications to Yes under App registrations section.
For details ,please refer to this troubleshoot document and similar ticket.
Related
I am trying to run an Azure Resource Group Deployment task in Azure Pipelines. I have deployed an Azure Pipelines self-hosted agent on an Azure VM running Windows, and in my Azure DevOps organization I have set up an Azure Resource Manager service connection to a VM with a managed service identity.
However, I get the following error when trying to configure my Azure Resource Group Deployment task with my service connection with managed identity:
GetUserAccessToken: Failed to obtain an access token of identity . AAD returned silent failure.
Screenshot:
I have already verified that I granted access (Contributor) to the VM's managed identity to the target resource group:
The service connection is also scoped to the Azure subscription:
Any help on diagnosing this issue is appreciated. Thanks!
Failed to obtain an access token typically occur when your session has expired.
To resolve these issues:
Sign out of Azure Pipelines or TFS.
Open an InPrivate or incognito browser window and navigate to https://visualstudio.microsoft.com/team-services/.
If you are prompted to sign out, do so.
Sign in using the appropriate credentials.
Choose the organization you want to use from the list.
Select the project you want to add the service connection to.
Create the service connection you need by opening the Settings page. Then, select Services > New service connection > Azure Resource Manager.
Refer to:
https://learn.microsoft.com/en-us/azure/devops/pipelines/release/azure-rm-endpoint?view=azure-devops#sessionexpired
In case this is useful to anyone else, I had a similar issue when modifying service connections through Azure DevOps. The solution provided by Charlie Brown pointed me in the right direction: The user in AAD isn't automatically added to the Azure DevOps Enterprise Application, so if you run into this it may mean that you need to add the user or group that's trying to access it through DevOps.
In my case I just added myself as and owner and user through the Azure Portal -> Azure Active Directory -> Enterprise Applications -> Azure DevOps.
I didn't have to create another user, nor modify anything with MFA.
It appears that the issue comes about because it is the user account authenticated to Azure DevOps that is retrieving subscription information. Azure DevOps is not using the managed identity to retrieve the subscription information.
In particular, my original Azure DevOps user account had MFA turned on to authenticate to an Azure subscription (e.g. portal.azure.com), but did not have MFA turned on to authenticate to Azure DevOps (e.g. dev.azure.com/). I think that this was causing the issue when failing to get an access token:
I created a different user account in my Azure AD, gave it access to my Azure DevOps organization, and made sure that this new user account had Reader permissions over the target subscription and did not have MFA turned on. This resolved the issue of getting subscription info when using managed identity:
My scenario getting this error was adding a Service Connection to a Management Group in Azure DevOps
GetUserAccessToken: Failed to obtain an access token of identity
{{GUID}}. AAD returned silent failure.
Fix for me was adding my account as a Project Collection Admin in DevOps... details below:
Tried every permission possible ... GA, ROOT Mgmt Group Owner (via AAD setting), target Mgmt Group Owner, Subscription Owner, App Administrator... In devops i am a project admin and i have Admin security role in service connections.
Interesting diff i have here, my Azure AD home tenant is different from my Azure Subscription AD tenant (i am a B2B Guest).
I actually tried to use a different DevOps tenant that has an AAD tied to the Azure Subscription tenant and it WORKED :( This lead me to diving further into what is different. Aside from the DevOps->AAD link, I am also COLLECTION admin on the working one, and only a project admin on the failing one. I made sure I had Management Group Owner rights and then added my account as a Project Collection Admin - WORKED!
Ref: https://developercommunity.visualstudio.com/solutions/1246044/view.html
I'm trying to register an application in Azure following these instructions in the link below.
I go to "App Registrations > New Registration" get the error "Access Denied You don’t have permission to register applications".
My user permission in the Azure Portal is Owner.
I can't find what permissions I need to set for my user so I can add a new app registration.
https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal
Owner role is an Azure RBAC role and is not the same as Azure AD directory roles which you need to register apps.
Azure RBAC roles apply to subscriptions and resources within them.
Azure AD tenants are above subscriptions.
Your Azure AD admin needs to give you at minimum Application Developer directory role.
Since I had access to more directory's I was just on the wrong one.
So in my case that was my problem and by switching directory to the correct one where I had access my problem was solved.
First I checked that I was given the access mentioned above.
I found out that you need to have owner rights of your subscription to add a Run as account in an Automation account. But as I search in my services I can see that my role inside the subscription is as an owner. Still i can't create a run as account because i don't have enough permissions ?
Is it enough to only have the owner rights of the subscriptions or do I need any more permissions ?
The issue was caused by you do not have the permission to create the AAD App.
If you want to configure Run As accounts, you also need to have the permission to create the AAD App.
For more details about the permissions, refer to this link.
Except for the permissions equivalent to the Owner role for Microsoft. Automation resources, you need to check these:
In the Azure portal, under Azure Active Directory > MANAGE > App registrations, if App registrations is set to Yes, non-admin users in your Azure AD tenant can register Active Directory applications. If App registrations is set to No, the user who performs this action must be a global administrator in Azure AD.
Ref: https://learn.microsoft.com/en-us/azure/automation/automation-create-standalone-account#permissions-required-to-create-an-automation-account
I am trying to setup Azure DevOps 'Release' Pipeline, when I am trying to add Azure Resource Manager service Connection, I am getting error like 'Failed to create an app in Azure Active Directory. Error: Insufficient privileges to complete the operation. For troubleshooting refer to link. '
My Organization assigned me an Azure Professional Subscription account. When I click the Active Directory, I am getting error like 'Access denied. You do not have access. Looks like you don't have access to this content. To get access, please contact the owner.'
What sort of user role, the organization needs to assign to me so that I can setup the Azure DevOps Release Pipeline.
The company can't give me the role as global administrator or user account administrator to ADFS, because of security reason. What is the appropriate ADFS user role permission my company should assign to me ?
There's no way to do this without being a Global Admin or Owner on the Azure Active Directory tenant. You need to request access from your organization or else make your own account with your own subscription and publish the application there.
You need to have the Application Administrator role in the AD in order to create the service connections.
After, enabling the Application Administrator role from the Azure Active Directory roles, I was able to create the service connection properly.
We are trying to create a service connection named, xyz-serviceconn-verify. Without any error message, now I could create service connections.
Here, you could see the created service connection, xyz-serviceconn-verify.
Good Luck :)
See the link, last error
https://learn.microsoft.com/en-us/azure/devops/pipelines/release/azure-rm-endpoint?view=azure-devops&viewFallbackFrom=vsts
This error is coming because you do not have sufficient privileges in your AAD, you do not have Write permission for the selected Azure subscription when the system attempts to assign the Contributor role.
It worked for me when I tried to create my own new AD, and then I move the subscriptions I got from the company to this AD (it is just for dev and test).
If you want it to work on production, maybe you should ask the administrator to create a new app registration for you and he should grant all permission to you inside this app (I guess).
Best regards,
Tai.
We are using VSTS/Azure DevOps to build and deploy our web services to Azure.
In the release step we use the Azure CLI build task to set up the environment for the web service. The build task uses a Service Connection to be authorized to do these actions.
The build task can create web services and deployment slots without issue, but when I try to instruct it to add a new reply url to the Azure AD application the web app uses to authenticate users, i see the following:
az ad app update --id 3e5a96e9-7311-4f92-869b-fbb5bbe8e41f --reply-urls http://mytestapp.azurewebsites.net
ERROR: Insufficient privileges to complete the operation.
The service connection used is an Azure RM service connection using a Service Principal. Is this correct? I'm guessing there is there a permission I need to set on the service principal, but which one?
Jayendran is correct. The user must be a member of Global Admin role in the directory because the Reply URL is added in the app registration.
You may also need to grant permissions to the app itself.
https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-integrate-apps-with-azure-ad
If you're looking to follow the least privileges principle and not assign the highest possible privilege available (as per your comment), I see 3 possible options that could work for you -
Owner for only a specific application (and NOT the Owner/Global Administrator for entire Azure AD)
You can add the user as Owner for only the specific application, which they need to manage (in your case, change reply URL's for).
Pro: Obviously the good thing about this approach is that this user gets to manage the app registration for only this particular application and none of the others in your Azure AD.
How: Go to "App Registrations" in Azure AD and navigate to the specific application. Now click on "Settings" and select "Owners"
Application Administrator Role
This one is a little more generic and a higher privilege in comparison to single application owner, as it gives the user access to manage application registrations for all applications.
Pro: Role is specific to only managing application registrations. It helps in a scenario where all applications need to be managed by this user.
How: Go to "Users" in your Azure AD and then select the specific user. Now go to "Directory Role" and add "Application Administrator Role"
Application Developer Role
This one is very similar to option 2 i.e. "Application administrator". Difference being that "Application developer" gets permissions for only those applications which they are developing, so the registration was done by them.
Pro: Good for user that is about to create and manage registrations for multiple applications.
How: Very similar to option 2 above.
More information about all the available roles and granular permissions that are used by these roles in Microsoft Docs:
Available Roles