{"action":"closed","issue":{"url":"https://api.github.com/repos/Azure/azure-xplat-cli/issues/2051","repository_url":"https://api.github.com/repos/Azure/azure-xplat-cli","labels_url":"https://api.github.com/repos/Azure/azure-xplat-cli/issues/2051/labels{/name}","comments_url":"https://api.github.com/repos/Azure/azure-xplat-cli/issues/2051/comments","events_url":"https://api.github.com/repos/Azure/azure-xplat-cli/issues/2051/events","html_url":"https://github.com/Azure/azure-xplat-cli/issues/2051","id":102364242,"number":2051,"title":"ARM: can't access 'Microsoft.Network/locations/operations/read' after login as --service-principal","user":{"login":"romangromov","id":1655573,"avatar_url":"https://avatars.githubusercontent.com/u/1655573?v=3","gravatar_id":"","url":"https://api.github.com/users/romangromov","html_url":"https://github.com/romangromov","followers_url":"https://api.github.com/users/romangromov/followers","following_url":"https://api.github.com/users/romangromov/following{/other_user}","gists_url":"https://api.github.com/users/romangromov/gists{/gist_id}","starred_url":"https://api.github.com/users/romangromov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/romangromov/subscriptions","organizations_url":"https://api.github.com/users/romangromov/orgs","repos_url":"https://api.github.com/users/romangromov/repos","events_url":"https://api.github.com/users/romangromov/events{/privacy}","received_events_url":"https://api.github.com/users/romangromov/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Azure/azure-xplat-cli/labels/Networking","name":"Networking","color":"DDDDDD"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2015-08-21T12:06:13Z","updated_at":"2016-07-15T01:33:50Z","closed_at":"2016-07-15T01:33:50Z","body":"Hello again,\r\n\r\nI'm using ` --service-principal` to login into ARM. Also, I've assign  an `Owner`, `Reader`, `Network Contributor` and `Virtual Machines Contributor` roles for my application, so I'm able to list/show resources in ARM. But when I try to `create/set/delete` something I'm getting error, please see repro steps below:\r\n\r\n**Step 1**: list all vnet, works fine\r\n```\r\nazure network vnet list test-roman-group\r\ninfo:    Executing command network vnet list\r\n+ Listing virtual networks\r\ndata:    ID                                                                                                                                             Name           Location  Address prefixes  DNS servers\r\ndata:    ---------------------------------------------------------------------------------------------------------------------------------------------  -------------  --------  ----------------  -----------\r\ndata:    /subscriptions/5893435f-6990-4bb3-bebb-b12f3535f990/resourceGroups/test-roman-group/providers/Microsoft.Network/virtualNetworks/MyNetwork      MyNetwork      westus    10.0.0.0/8\r\ndata:    /subscriptions/5893435f-6990-4bb3-bebb-b12f3535f990/resourceGroups/test-roman-group/providers/Microsoft.Network/virtualNetworks/MyTestNetwork  MyTestNetwork  westus    10.0.0.0/8\r\ndata:    /subscriptions/5893435f-6990-4bb3-bebb-b12f3535f990/resourceGroups/test-roman-group/providers/Microsoft.Network/virtualNetworks/RogromNetwork  RogromNetwork  westus    10.0.0.0/8\r\ndata:    /subscriptions/5893435f-6990-4bb3-bebb-b12f3535f990/resourceGroups/test-roman-group/providers/Microsoft.Network/virtualNetworks/RomanNetwork   RomanNetwork   westus    10.0.0.0/8\r\ninfo:    network vnet list command OK\r\n```\r\n\r\n**Step 2**: create new vnet with name **DeleteMe**, getting **authorization error**:\r\n```\r\nazure network vnet create test-roman-group DeleteMe \"West US\"\r\ninfo:    Executing command network vnet create\r\n+ Looking up virtual network \"DeleteMe\"\r\n+ Creating virtual network \"DeleteMe\"\r\nerror:   The client '69f2b9f5-fe10-4cb3-902e-8238f8f8a1c0' with object id '69f2b9f5-fe10-4cb3-902e-8238f8f8a1c0' does not have authorization to perform action 'Microsoft.Network/locations/operations/read' over scope '/s\r\nubscriptions/5893435f-6990-4bb3-bebb-b12f3535f990'.\r\ninfo:    Error information has been recorded to C:\\Users\\roman.gromov\\.azure\\azure.err\r\nerror:   network vnet create command failed\r\n```\r\n\r\n**Step 3**: again, list all vnet, and **DeleteMe** network is there!\r\n```\r\nazure network vnet list test-roman-group\r\ninfo:    Executing command network vnet list\r\n+ Listing virtual networks\r\ndata:    ID                                                                                                                                             Name           Location  Address prefixes  DNS servers\r\ndata:    ---------------------------------------------------------------------------------------------------------------------------------------------  -------------  --------  ----------------  -----------\r\ndata:    /subscriptions/5893435f-6990-4bb3-bebb-b12f3535f990/resourceGroups/test-roman-group/providers/Microsoft.Network/virtualNetworks/DeleteMe       DeleteMe       westus    10.0.0.0/8\r\ndata:    /subscriptions/5893435f-6990-4bb3-bebb-b12f3535f990/resourceGroups/test-roman-group/providers/Microsoft.Network/virtualNetworks/MyNetwork      MyNetwork      westus    10.0.0.0/8\r\ndata:    /subscriptions/5893435f-6990-4bb3-bebb-b12f3535f990/resourceGroups/test-roman-group/providers/Microsoft.Network/virtualNetworks/MyTestNetwork  MyTestNetwork  westus    10.0.0.0/8\r\ndata:    /subscriptions/5893435f-6990-4bb3-bebb-b12f3535f990/resourceGroups/test-roman-group/providers/Microsoft.Network/virtualNetworks/RogromNetwork  RogromNetwork  westus    10.0.0.0/8\r\ndata:    /subscriptions/5893435f-6990-4bb3-bebb-b12f3535f990/resourceGroups/test-roman-group/providers/Microsoft.Network/virtualNetworks/RomanNetwork   RomanNetwork   westus    10.0.0.0/8\r\ninfo:    network vnet list command OK\r\n\r\n```\r\n\r\n* Can you please help me to figure out how to avoid this authorization error (do I need to grant something to my application?)\r\n* Also, could this be a security risk (vnet created even after authorization error)?\r\n\r\nI am hope for your help, thanks in advance!\n<!---@tfsbridge:{\"tfsId\":4546593}-->"}}
{"actor":{"display_login":"amarzavery"}}