2

I am trying to run the following powershell command on an Azure API Management resource group:

Test-AzureRmResourceGroupDeployment -ResourceGroupName api-dev-81575006 -TemplateFile .\api-dev.json -TemplateParameterFile .\api-dev.parameters-TEST.json

However I get the following error:

Test-AzureRmResourceGroupDeployment : The client 'xx.xx@blabla.com' with object id '89e711a3-374d-4594-8aba-e0108edf2a87' does not have authorization to perform action 
'Microsoft.Resources/deployments/validate/action' over scope

I looked at my role in the resource group and I have contributor role. Shouldn't this be sufficient for me to run validate commands on resource groups?

Souciance Eqdam Rashti
  • 3,143
  • 3
  • 15
  • 31

1 Answers1

4

yeah, thats sufficient, so you've got few options here:

  1. you dont know who you actually are. i.e. powershell is authenticated under a different user. (Get-AzContext will show you this information)
  2. you are deploying to the wrong resource group (so not the one you checked permissions)
  3. you are deploying to the wrong subscription (Get-AzContext will show you this information; you can switch subscription with Select-AzSubscription)

also, worth noting, that i'm 99% sure that cmdlet doesnt do what you think it does ;)

Tiamo Idzenga
  • 1,006
  • 11
  • 23
4c74356b41
  • 69,186
  • 6
  • 100
  • 141
  • In what way doesn't it do what I think it does? It should validate an arm template deployment with the parameter files. Or have I misstaken something? – Souciance Eqdam Rashti Dec 06 '18 at 11:40
  • not necessary, and even if that cmdlet returns OK it doesnt mean that the template will actually work (in small\easy templates it most likely will). also, when you run `New-AzResourceGroupDeployment` it does run that validation before actually running the template. so its not really usefull – 4c74356b41 Dec 06 '18 at 11:42
  • That is true, am aware of that, but right now we are just trying to evaluate various validation steps for a complete pipeline. Normally we deploy via Azure devops and use the validate step there. This is just for evaluation purpose. – Souciance Eqdam Rashti Dec 06 '18 at 11:49
  • 1
    Wrong subscription. Thanks for the help. – Souciance Eqdam Rashti Dec 06 '18 at 11:59