<p>I'm creating kubernetes service in Azure with Advanced Networking options where I've selected particular vNet and Subnet for it.</p>

<p>I'm getting error as below:</p>

<pre><code>{"code":"InvalidTemplateDeployment","message":"The template deployment failed with error: 'Authorization failed for template resource '&lt;vnetid&gt;/&lt;subnetid&gt;/Microsoft.Authorization/xxx' of type 'Microsoft.Network/virtualNetworks/subnets/providers/roleAssignments'. The client '&lt;emailid&gt;' with object id 'xxx' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' at scope '/subscriptions/&lt;subid&gt;/resourceGroups/&lt;rgid&gt;/providers/Microsoft.Network/virtualNetworks/&lt;vnetid&gt;/subnets/&lt;subnetid&gt;/providers/Microsoft.Authorization/roleAssignments/xxx'.'."}
</code></pre>

<p>I've got contributor role.</p>

<p>the existing answer is not exactly true, you can get away with the <code>Owner</code> role, obviously, but you only need <code>Microsoft.Authorization/roleAssignments/write</code> over the scope of the subnet (might be vnet, didnt test this). which helps lock down security little bit. You'd need a custom role to do that. In case you dont want to go for the custom role, existing answer will be just fine.</p>
