DevOps Practices and IT Operations
Role Assignment Exists or Role Assignment Update Not Permitted
Azure role-based access control (Azure RBAC) is the authorization system you use to manage and granting access to Azure resources. You can use Azure Resource Manager templates (JSON or Bicep) to automate the role assignments; for example Assign a user, group or service principal with ‘Contributor’, ‘Reader’ roles. You might encounter folliwing issue when you are trying to make the deployment repetitive:
When defining the template for deployment, the guid value is used for the resource name (example shows below). The template is not idempotent unless the same role name guid is provided. In this case, we just need to obtain a guid value and then assign it as the template resource name, then the issue will be resolved.
Obtain a new GUID value by running following command on PowerShell window:
Copy/paste the GUID value to the template (my example uses Bicep template below):
Note: this particular GUID value is only used for this particular role assignment, if you want to have another role assignment, then a new GUID value needs to be created.
That is all, once you assign the static GUID value, then you can repeat the deployment as many times as you would like to, the issue won’t appear again.
Reference : Assign Azure roles using Azure Resource Manager templates
Browse More ..
"Role Assignment Update Not Permitted" error while Deploying the Orchestrator from Azure Marketplace
How to solve "role assignment update not permitted" error while deploying the orchestrator from azure marketplace.
Follow the below steps to solve this issue-
- Delete Unknown roles assignments in subscription
- Delete Unknown roles assignments in RG added by previous failing deployment
- Delete certificate added by previous failing deployment in https://resources.azure.com/ > subscriptions > resourceGroups > providers/Microsoft.Web/certificates
- Add Standard_D2_v3 to allowed virtual machine SKUs policy
Related Topics
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
How to create second role assignment for an existing role
I receive an error Updating SQL Role Assignment Principal ID is not permitted. You may only update the associated Role Definition. when I'm trying to create new role assignment with existing role.
But I'm not updating role assignment, I'm creating a new one.
How to make it work?
First, already existing and deployed role assignment:
Second role assignment I'm trying to create:
Role definition:
Azure Cosmos DB An Azure NoSQL database service for app development. 1,422 questions Sign in to follow
Your code sections don't work, so pasting just as text.
Hi, @Konstantin Kulikov Welcome to Microsoft Q&A thanks for posting your question.
I understand that you are trying to create a new role assignment with an existing role in Microsoft Azure Cloud, but you have received an error message that says "Updating SQL Role Assignment Principal ID is not permitted.
Looking into the bicep you have share the principalid is different.If you are adding additional role assignments, you need to change only the role definitionid and leave the principal id the same,
Let me know if this fixes your issue. Regards
Hi, thanks for the answer.
But I want to use the same role but in another application.
Shouldn't principalId be changed then?
@Konstantin Kulikov the principal id is the identification of the user, aren't you attempting to add a role to the same principal id?
What users are you talking about?
Once again:
- there is ONE ROLE for ONE DATABASE ;
- there are TWO DIFFERENT APPLICATIONS in the same resource group. I want these TWO DIFFERENT APPLICATIONS to use the SAME ROLE for SAME DATABASE ;
- there are TWO DIFFERENT ROLE ASSIGNEMENTS for each of those applications.
Whom do you call a user?
aren't you attempting to add a role to the same principal id?
What I'm trying to do is written in the first sentence of the initial message:
I'm trying to create new role assignment with existing role
@Konstantin Kulikov I think this is the problem
resource functionAppContributorRole 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2023-11-15' = {
parent: cosmosAccount
name: guid('functionAppContributorRole')
properties: {
roleDefinitionId: cosmosContributorRole.Id
principalId: functionApp.identity.principalId
scope: cosmosAccount.id
The one highlighted in Bold, its treating it as an update instead of creating a new one you can either not supply it or create a new name.
Search code, repositories, users, issues, pull requests...
Provide feedback.
We read every piece of feedback, and take your input very seriously.
Saved searches
Use saved searches to filter your results more quickly.
To see all available qualifiers, see our documentation .
- Notifications
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement . We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
RoleAssignmentUpdateNotPermitted when installing the azure template #363
hrcerqueira commented Jul 9, 2019
akshaysngupta commented Jul 12, 2019
Sorry, something went wrong.
akshaysngupta commented Aug 21, 2019
arpitjain099 commented Aug 29, 2019
snapfisher commented Feb 14, 2020
DazzaDroid commented Mar 3, 2020
Snapfisher commented mar 3, 2020.
- 👍 1 reaction
DazzaDroid commented Mar 4, 2020 • edited
Snapfisher commented mar 4, 2020 via email.
ThomasDetemmerman commented May 26, 2021 • edited
- 👍 4 reactions
johnib commented Jan 15, 2023
No branches or pull requests
IMAGES
VIDEO
COMMENTS
Show the properties of a SQL role assignment under an Azure Cosmos DB account. Core GA az cosmosdb sql role assignment update: Update a SQL role assignment under an Azure Cosmos DB account. Core GA az cosmosdb sql role assignment wait: Poll on a SQL role assignment until a specific condition is met. Core GA
I am doing an incremental ARM Template update as below and the first time I run it, it works, and every subsequent deployment I get this error: Updating SQL Role Assignment Scope is not permitted. You may only update the associated Role Definition
For more information, see Create Azure RBAC resources by using Bicep.. Symptom - Role assignments with identity not found. In the list of role assignments for the Azure portal, you notice that the security principal (user, group, service principal, or managed identity) is listed as Identity not found with an Unknown type.. If you list this role assignment using Azure PowerShell, you might see ...
Steps to reproduce. Create a CosmosDB sql role assignment, deploy stack with pulumi to Azure, change assignment scope and redeploy stack. "role-name", new() ResourceGroupName = args.ResourceGroup.Name, AccountName = args.Account.Name, PrincipalId = principalId, Scope = assignmentScope, RoleDefinitionId = GetCosmosDataContributorRole(args ...
In the URL for the REST API call, the GUID for the "roleAssignmentId" should be unique for each assignment per scope, principal, and role. That's referenced in step 2 in the URL I provided above. If an assignment has been orphaned, the principal has been deleted but not the assignment or scope, then you should clean those up. Like Like
Looks as if terraform is creating all the azurerm_cosmosdb_sql_role_assignment resources all at once and cosmos is not happy with it. I also tried to link one assignment to the other using the depends_on directive but it didn't' help at all. I had to perform terraform apply four times, which is far from ideal.
Subsequent deployments are failing on alz-Sql... Skip to content. Toggle navigation. Sign in ... application ID, principal ID, and scope are not allowed to be updated" ... (not the management group) and delete orphaned identities (Identity Not Found) under IAM Role Assignments. There are two managed identities that get orphaned when you do this ...
Note: Role Assignment Update are not permitted. Make sure you pass an unique GUID for every new role assignment. Scope is the boundary that the access applies to. When you assign a role, you can further limit the actions allowed by defining a scope. Contributor - Can create and manage all types of Azure resources but can't grant access to others.
Solution 1. Ensure that the security principals don't have multiple role assignments (with or without conditions) that grant access to the same data action leading to non-enforcement of conditions. For information about the evaluation logic, see How Azure RBAC determines if a user has access to a resource. Cause 2.
However, the SQL Server Logins are not transported with the database backup. Option 1: Create a SQL Server Login with the same password. Option 2: Backup the SQL Server Login on the old SQL Server and transport to the new server. Option 3: Use Windows Authenticated Accounts/Groups. Option 4: Use some 3rd party tool.
Azure role-based access control (Azure RBAC) is the authorization system you use to manage and granting access to Azure resources. You can use Azure Resource Manager templates (JSON or Bicep) to automate the role assignments; for example Assign a user, group or service principal with 'Contributor', 'Reader' roles.
Currently you use the subscription().id as a seed value for the guid() function. But, this role assignment is scoped to a resource group, so you should use resourceGroup().id. With the current implementation, you won't be able to create multiple role assignments in different resource groups because they all generate the same GUID name.
Azure Marketplace Deployment Fails Validation For Resource Group-Related Configuration
@thepaulmacca I can see the issue. In the failing Bicep code, you have two different resources that generate the same name. Both role assignments create a GUID with the same name.
Thanks for contributing an answer to Stack Overflow! Please be sure to answer the question.Provide details and share your research! But avoid …. Asking for help, clarification, or responding to other answers.
Note: The Object ID property located on the App registrations > Overview page of the Entra service principal or group is not the correct Object ID for the 'WITH OBJECT_ID' clause. However, you can navigate to the correct OID from this view by selecting the Managed application in local directory principal name. Using the OBJECT_ID syntax
You may only update the associated Role Definition. when I'm trying to create new role assignment with existing role. But I'm not updating role assignment, I'm creating a new one. How to make it work?
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window.
The issue that you are facing is when you deploy the ARM template for first time the identity is recently created that has not yet been fully replicated so you might notice that the security principal (user, group, service principal, or managed identity) is listed as Identity not found with an Unknown type. And when you try to update the same ...