paritosh mishra
paritosh mishra

Reputation: 3

Unable to create a Service Connection from Devops when we have using Azure Cross Tenant synconization

Background Two Azure Tenants:

Corporate Tenant: Used for user provisioning, onboarding, and DevOps service authentication. Platform Tenant: Used for Azure Resource deployment. Cross-Tenant Synchronization: User objects are copied from the Corporate Tenant to the Platform Tenant. However, the user object IDs differ between tenants.

Issue: When creating a service connection from DevOps service, the service principal (SP) is created in the Corporate Tenant.

Throw error as

Failed to set Azure permission 'RoleAssignmentId: 0dc361ac-5b3c-4389-95bd-2a83XXXXX' for the service principal '42793a46-ZZZZZZZZZ' on subscription ID '21d481a7-c943-4c50-8450-CCCCCCCCCCCCCC': error code: Forbidden, inner error code: AuthorizationFailed, inner error message The client '[email protected]' with object id '6906412c-10de-4060-ab64-xxxxxxxxxx' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/21d481a7-vvvvvvvvvvvvvv/resourceGroups/poccccc/providers/Microsoft.ContainerRegistry/registries/ibrrrrrrrrrrr/providers/Microsoft.Authorization/roleAssignments/0dc361ac-5b3c-4389-95bd-nnnnnnnnnn' or the scope is invalid. If access was recently granted, please refresh your credentials. Ensure that the user has 'Owner' or 'User Access Administrator' permissions on the Subscription..

I am owner of the Platform Tenant

Plese help me out

Issue Might be : When creating a service connection from DevOps service, the service principal (SP) is created in the Corporate Tenant. However, an error occurs due to a mismatch in object IDs between the tenants, leading to authorization issues.

Upvotes: 0

Views: 24

Answers (0)

Related Questions