1

I'm trying to use the Azure REST api to create role assignments, but it's giving an error:
Exception: {"error":{"code":"PrincipalNotFound","message":"Principal 83ad8925d1714aa380a8555cec2d400c does not exist in the directory ####-####-####"}}

            var url = $"https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Authorization/roleAssignments/{Guid.NewGuid()}?api-version=2015-07-01";
            object payload = new
            {
                properties = new
                {
                    roleDefinitionId = role.id,
                    principalId
                }
            };
            await PutAsync<object>(url, payload);

Switching the API version to 2018-09-01-preview does not prevent the issue from occurring.

Related links

TeamDman
  • 649
  • 6
  • 26

1 Answers1

0

Seems to be an issue caused by replication delay on Microsoft's side.
Attempting to create the role assignment right after creating the security group principal can sometimes result in this error.

I resolved this by just putting my API call in a try-catch with 20 retries with a 20 second delay between each attempt. Eventually it just succeeds.

Note that the error message provided by the API doesn't contain the hyphens/dashes in the GUID, this does NOT mean you passed a bad GUID, the error message is just misleading.

TeamDman
  • 649
  • 6
  • 26
  • 1
    Certain APIs make newly created object available immediately while others don't; I had the same problem with [inviting users and assigning them app roles asap](https://stackoverflow.com/questions/66976647/is-it-not-guaranteed-when-the-graph-service-call-returns-that-the-user-has-been). Pretty unfortunate behavior to have to deal with. In my case, waiting 400 seconds wasn't acceptable. – ChiefTwoPencils Mar 30 '22 at 21:26
  • I'd be curious if using an exponential back off would help speed it up or slow it down. `var seconds = (int)Math.Pow(2,retryCount);` – ChiefTwoPencils Mar 30 '22 at 21:28