CODEWITHSUNDEEP
azureazure-devopsazure-active-directoryazure-web-app-service
Edmond Tamas
Edmond Tamas

Reputation: 3285

Insufficient permissions to create Azure DevOps project while having Owner permission

After being invited to a client's Azure account and having "Owner" role + access to "Azure AD user, group, service principal" granted I am able create App Services, import source from Github but when I try to create a DevOps project to start actual work I get an error:

enter image description here

Following the link towards more details I can see that its about permission issue but if I re-check my permissions:

enter image description here

It says "Owner" but the scope is: "This resource" - note that these infos are under the single Subscription that my client created, however if I click my name for detailed view on my identity I see "Guest":

enter image description here

What would be the proper way to grant me global permissions on my clients Azure account?

Thanks!

Upvotes: 0

Views: 1575

Answers (1)

Joy Wang
Joy Wang

Reputation: 42043

If you create a project, it will automatically create an AD App named like organizationname-projectname-513f22f1-befd-xxxxxxcfe90f1 in the App Registerations in your tenant.

To fix the issue, let the global admin of your tenant to modify the user settings. Navigate to the Azure Active Directory in the portal -> User settings -> set Users can register applications to Yes.

enter image description here

Then in the Manage external collaboration settings, set the Guest users permission are limited to No.

enter image description here

enter image description here

Besides, if you can get an administrator role, no matter the settings are, you can create the app directly.

Upvotes: 1

Related Questions