title: Azure LinkedAuthorizationFailed on Active Directory Account / Key Vault Authentication when running DevOps Server Deployment Template
body: <p>I am trying to deploy an on-prem instance of Azure DevOps Server to a VM in an Azure Government subscription (which by nature, seems it does not support standard DevOps).</p>
  <p>This template is referenced within support material directly from Microsoft:</p>
  <p><a href="https://github.com/usri/deploy_DevOps_Server_AzureSQL" rel="nofollow noreferrer">https://github.com/usri/deploy_DevOps_Server_AzureSQL</a></p>
  <p>All the referenced resources were created from scratch for the purpose of getting this server running.</p>
  <p>This requires an AAD account with the associated password stored in a Key Vault. However, every attempt I make to run the template returns the following error on the 'Write VirtualMachines' step (when all other components pass):</p>
  <blockquote>
  <p>The client has permission to perform action <code>'Microsoft.Compute/images/read'</code> on scope <code>'(MY_SUBSCRIPTION)\(MY_RESOURCEGROUP)\(VM)'</code>, however the current tenant <code>'(MY_KEYVAULT)'</code> is not authorized to access linked subscription '(ID in the template with the deployment files)'</p>
  </blockquote>
  <p>This seems to me like the password cannot be retrieved from Key Vault- is it a formatting issue with the Secret? An access control issue somewhere? I've tried many various combinations of both. Hopefully this is just a trivial issue..</p>