I learned that it's not enough to authorize Azure Resource Manager access from DevOps
Last updated
Oh boy, did I waste time on this one :(. So I had my pipeline pretty naively doing an upload to blob storage:
I used a service principal . The blob storage account was under the same subscription, where the automatically created app properly showed up in IAM:
as a contributor:
I kept getting a 403 response when the task run, with the message This request is not authorized to perform this operation using this permission.
In the process I learned how DevOps creates the app registration and what-not, but still, not fun.
Turns out being a Contributor is not enough. I tried , but in the end the only thing that worked was manually adding the , which I found mentioned in a.
for the so this is more easily discoverable.
