Failed to check the resource group status: 403 while deploying ARM template using CD pipeline through service principal/connection

Question

While deploying Azure Data Factory's ARM template through service principal, I am getting below error:

[error]Failed to check the resource group status. Error: {"statusCode":403}.

Is it a service connection Access related issue? How to check/resolve this?

Assignor

learn.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/… – Peddada

Answer 1

The error means the service principal used in your Azure DevOps service connection does not have enough permission to perform the action.

To solve the issue, you need to add an Azure RBAC role for the service principal, navigate to the Project Settings in Azure DevOps -> Service connections -> find the service connection you used(whose type is Azure Resource Manager) and select it -> select Manage service connection roles.

Then it will open a page for the Azure subscription in Azure portal, navigate to the Access control (IAM) -> add your service principal as a Contributor role as below.

Note: To assign the role for your service principal, your user account logged in Azure portal needs the RBAC role e.g. Owner, User Access Administrator.

Kuibyshev

Although I agree that @Joy Wang's solution will work, be aware of 2 things: 1 - This solution is an overkill, as you don't need to assign the Service Principal to the whole subscription, you can do this at the resource group level instead (just do exactly what Joy is telling but at the Resource Group level instead of at the Subscription Level). 2 - The other important thing to say is that this error can also happen if in the pipeline you didn't name the resource group correctly or if you didn't add the right subscription ID. – Fervidor

I had the same error with a function app deployment using Azure DevOps pipeline task "Azure Functions Deploy v2" with a self-hosted build agent running on azure container instance. In my case issue issue was due to missing RBAC permissions for the managed identity running azure DevOps service. – Greta