Azure Automation - Unable to Remove-AzResourceLock

Question

I have an issue deleting an Azure Lock, at the resource group level. I am doing it from an Azure Runbook.

I authenticate fine (I am able to Get details of whatever I want). Here's the code for that:

# Ensures you do not inherit an AzureRMContext in your runbook
Disable-AzContextAutosave –Scope Process
"Logging in to Azure..."
$connection = Get-AutomationConnection -Name AzureRunAsConnection
Connect-AzAccount -ServicePrincipal -Tenant $connection.TenantID -ApplicationId $connection.ApplicationID -CertificateThumbprint $connection.CertificateThumbprint

And if I do, say, Get-AzResource -ResourceGroupName $RG, I get the info I need. But the problem is that I actually need to delete some resources of that resource group, and it has a lock.

When I Remove-AzResourceLock -LockId $getAzureLock.LockId -Force, I am thrown this:

Remove-AzResourceLock : AuthorizationFailed : The client XX with object id XX does not have authorization to perform action 'Microsoft.Authorization/locks/delete' over scope '/subscriptions/<redacted>/resourceGroups/<redacted>/providers/Microsoft.Authorization/locks/resourceDellock' or the scope is invalid. If access was recently granted, please refresh your credentials.

FYI, I've redacted the subscription/object id information.

For the life of me, I am not able to get around it. The application is added as a Contributor at the subscription level, from Access Control (IAM).

I have tried so many things, that I am just to tired to write down! I am sorry. The last 4 hours I've been reading and trying stuffs. So pardon me!

Please, help me get around this..

BTW,all this work seamlessly from VSCode. – Anonymous Person Jun 29 '20 at 15:06 — Anonymous Person, Jun 29 '20 at 15:06

score 2 · Accepted Answer · answered Jun 29 '20 at 15:16

As per the documentation, only Owner and User Access Administrator built-in roles have the permission to delete a lock and not the Contributor role.

Deletes the management lock of a resource or any level below the resource. To delete management locks, you must have access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions. Of the built-in roles, only Owner and User Access Administrator are granted those actions.

So your solution would be to either grant Owner/User Access Administrator role to your service principal or create a custom role and grant appropriate permissions on Microsoft.Authorization/* actions.

WHO ARE YOU? Also, it worked. I changed the role to `User Access Administrator` and it helped. Thank you very much. — Anonymous Person, Jun 29 '20 at 15:27

Azure Automation - Unable to Remove-AzResourceLock

1 Answers1