Sync Cloud endpoint cant be created

Describe the bug

It is not possible to create a sync cloud endpoint within a Sync Group through the CLI. This is because the Storage Sync needs a role on the storage account that it does not get. When creating a cloud endpoint with the portal / Powershell it does automatically get created.

With the CLI this does not work and after ~ 10 minutes an error appears.

Related command

az storagesync sync-group cloud-endpoint create --name $cloudEndPointName --storage-sync-service $storageSyncName --sync-group-name $syncGroupName --resource-group $resourceGroupName --storage-account $storageAccountName ` --azure-file-share-name $fileshareName

Errors

ERROR: (MgmtStorageAccountAuthorizationFailed) Unable to read specified storage account. Please check the permissions and try again after some time.
Code: MgmtStorageAccountAuthorizationFailed
Message: Unable to read specified storage account. Please check the permissions and try again after some time.

Issue script & Debug output

DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/925e5637-72f0-4620-888f-ea47897a8021/resourceGroups/ENVIRONMENT-WE-ResourceGroup/providers/Microsoft.StorageSync/storageSyncServices/ENVIRONMENT-WE-INTEGRATION-STORAGE-SYNC/workflows/7c9518dc-7f47-4f89-9277-94c4df86d83a/operations/d3ef7bbe-df42-474f-ab5f-f5ee0f995f6c?api-version=2019-06-01&t=638467033091153350&c=MIIHHjCCBgagAwIBAgITfwKVua8WD85fcpddlwAEApW5rzANBgkqhkiG9w0BAQsFADBEMRMwEQYKCZImiZPyLGQBGRYDR0JMMRMwEQYKCZImiZPyLGQBGRYDQU1FMRgwFgYDVQQDEw9BTUUgSW5mcmEgQ0EgMDIwHhcNMjQwMTMwMDIwNjI3WhcNMjUwMTI0MDIwNjI3WjBAMT4wPAYDVQQDEzVhc3luY29wZXJhdGlvbnNpZ25pbmdjZXJ0aWZpY2F0ZS5tYW5hZ2VtZW50LmF6dXJlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL-aBOq-7WPUEuGWxyKwzwxwU4AnFYQ1wG3QPrQHR5_d6EfVmd_19f2l9lnqgWnTn_AoaWklL8v7IUSujh6ULLhc5XcTuYB_2w_VgDjnlHSI3q-Pck2-FTkQ4JH0lJRWC7mOd15mL-Yvt4BxfzJS7COkAT5e2qRh2KLryoAC0RatIMXGJYRaTpiiOAo-tzDyuFnHdtZgAoTzVurWcZNZl8PWSpp1CtjMHQz-RoKKco2ftpvBJJsZKTUvUVmKJCkg_N99yA0wXVPCekuP4SMSCpcBxkmYAalhw58MBjYX4M_V1zH7ERjh_qa71V5w5cAXkmWe6MsS_nfQ4XkZ_5c_b80CAwEAAaOCBAswggQHMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwEwCgYIKwYBBQUHAwIwPQYJKwYBBAGCNxUHBDAwLgYmKwYBBAGCNxUIhpDjDYTVtHiE8Ys-hZvdFs6dEoFggvX2K4Py0SACAWQCAQowggHaBggrBgEFBQcBAQSCAcwwggHIMGYGCCsGAQUFBzAChlpodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpaW5mcmEvQ2VydHMvQkwyUEtJSU5UQ0EwMS5BTUUuR0JMX0FNRSUyMEluZnJhJTIwQ0ElMjAwMig0KS5jcnQwVgYIKwYBBQUHMAKGSmh0dHA6Ly9jcmwxLmFtZS5nYmwvYWlhL0JMMlBLSUlOVENBMDEuQU1FLkdCTF9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3J0MFYGCCsGAQUFBzAChkpodHRwOi8vY3JsMi5hbWUuZ2JsL2FpYS9CTDJQS0lJTlRDQTAxLkFNRS5HQkxfQU1FJTIwSW5mcmElMjBDQSUyMDAyKDQpLmNydDBWBggrBgEFBQcwAoZKaHR0cDovL2NybDMuYW1lLmdibC9haWEvQkwyUEtJSU5UQ0EwMS5BTUUuR0JMX0FNRSUyMEluZnJhJTIwQ0ElMjAwMig0KS5jcnQwVgYIKwYBBQUHMAKGSmh0dHA6Ly9jcmw0LmFtZS5nYmwvYWlhL0JMMlBLSUlOVENBMDEuQU1FLkdCTF9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3J0MB0GA1UdDgQWBBRG96ol681QhZp5pSqJ6oYOZNt0GzAOBgNVHQ8BAf8EBAMCBaAwggE1BgNVHR8EggEsMIIBKDCCASSgggEgoIIBHIZCaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraWluZnJhL0NSTC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JshjRodHRwOi8vY3JsMS5hbWUuZ2JsL2NybC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JshjRodHRwOi8vY3JsMi5hbWUuZ2JsL2NybC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JshjRodHRwOi8vY3JsMy5hbWUuZ2JsL2NybC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JshjRodHRwOi8vY3JsNC5hbWUuZ2JsL2NybC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JsMBcGA1UdIAQQMA4wDAYKKwYBBAGCN3sBATAfBgNVHSMEGDAWgBSuecJrXSWIEwb2BwnDl3x7l48dVTAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBAKKyAgJAkf6JZxLet4ea9iH2HJ_f1HvcVdJfcdpi8oDbTqA74VfwpfgAuboGp1Dxfz5bVflauzzjt_qdGY2Mg3AZsW1CF9KsffviftutQ_em6LBVWyYMbvf4BPcAJ1PLSwjAELsRMysZocC5gvDWrgMvFA1SfAq6khqAbIeAPqd0aTddcHAtS-LceawwUGup6SNsK_yHwLiu7_qR-0RSxvj5lJfViUuKZKrCJAoMZDMAH2C_4HnZPYptyGijrbSTn5A3Whoc6TOM1Mmw7-zZODT8RjZ62a_2hMS8at50D_uAtvTgOjZZyP6f3q5eIREJU-8uer5Rlmz97XHtmEJGoiY&s=NDY0C_DcpVE8-I2dKoE5zD0AfSesr1LzToWthO24qiigY2UuFiYXbMWndggX3EVDxeHkAcJzDE_l28UuLbojMR35-DhbbYjQpkbytYQHxIe2xsEoyjRvLGhuUoACcJEG14qHGpseUp5Jm8gTqTeL3wip_IdqYgqXrbnP2Xw2TqYcrzeA-r5sQlbK1To9XWsQq0jcLn-FkBkiGIdihq2vde2Lqfn2UZr8rP3u4D5322T5fp3nBr3AAhw1T_Re5f4YhLyHBTHAWvYwrxwUBAQpwCLfpJLosjROm1s_790ZMQDlielzmC5GYOkERoYclZLfeokzgbUE036hh13KfdmW_Q&h=zEcXL9wLK67dyeNM-UXelquBxR76Bo_dlxkj3AHhgAU'
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies:     'x-ms-client-request-id': '5ee236dc-e83e-11ee-9f0a-ecfe3f375160'
DEBUG: cli.azure.cli.core.sdk.policies:     'CommandName': 'storagesync sync-group cloud-endpoint create'
DEBUG: cli.azure.cli.core.sdk.policies:     'ParameterSetName': '--name --storage-sync-service --sync-group-name --resource-group --storage-account --azure-file-share-name --debug'
DEBUG: cli.azure.cli.core.sdk.policies:     'User-Agent': 'AZURECLI/2.56.0 (MSI) azsdk-python-mgmt-storagesync/1.0.0 Python/3.11.5 (Windows-10-10.0.22631-SP0)'
DEBUG: cli.azure.cli.core.sdk.policies:     'Authorization': '*****'
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/925e5637-72f0-4620-888f-ea47897a8021/resourceGroups/ENVIRONMENT-WE-ResourceGroup/providers/Microsoft.StorageSync/storageSyncServices/ENVIRONMENT-WE-INTEGRATION-STORAGE-SYNC/workflows/7c9518dc-7f47-4f89-9277-94c4df86d83a/operations/d3ef7bbe-df42-474f-ab5f-f5ee0f995f6c?api-version=2019-06-01&t=638467033091153350&c=MIIHHjCCBgagAwIBAgITfwKVua8WD85fcpddlwAEApW5rzANBgkqhkiG9w0BAQsFADBEMRMwEQYKCZImiZPyLGQBGRYDR0JMMRMwEQYKCZImiZPyLGQBGRYDQU1FMRgwFgYDVQQDEw9BTUUgSW5mcmEgQ0EgMDIwHhcNMjQwMTMwMDIwNjI3WhcNMjUwMTI0MDIwNjI3WjBAMT4wPAYDVQQDEzVhc3luY29wZXJhdGlvbnNpZ25pbmdjZXJ0aWZpY2F0ZS5tYW5hZ2VtZW50LmF6dXJlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL-aBOq-7WPUEuGWxyKwzwxwU4AnFYQ1wG3QPrQHR5_d6EfVmd_19f2l9lnqgWnTn_AoaWklL8v7IUSujh6ULLhc5XcTuYB_2w_VgDjnlHSI3q-Pck2-FTkQ4JH0lJRWC7mOd15mL-Yvt4BxfzJS7COkAT5e2qRh2KLryoAC0RatIMXGJYRaTpiiOAo-tzDyuFnHdtZgAoTzVurWcZNZl8PWSpp1CtjMHQz-RoKKco2ftpvBJJsZKTUvUVmKJCkg_N99yA0wXVPCekuP4SMSCpcBxkmYAalhw58MBjYX4M_V1zH7ERjh_qa71V5w5cAXkmWe6MsS_nfQ4XkZ_5c_b80CAwEAAaOCBAswggQHMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwEwCgYIKwYBBQUHAwIwPQYJKwYBBAGCNxUHBDAwLgYmKwYBBAGCNxUIhpDjDYTVtHiE8Ys-hZvdFs6dEoFggvX2K4Py0SACAWQCAQowggHaBggrBgEFBQcBAQSCAcwwggHIMGYGCCsGAQUFBzAChlpodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpaW5mcmEvQ2VydHMvQkwyUEtJSU5UQ0EwMS5BTUUuR0JMX0FNRSUyMEluZnJhJTIwQ0ElMjAwMig0KS5jcnQwVgYIKwYBBQUHMAKGSmh0dHA6Ly9jcmwxLmFtZS5nYmwvYWlhL0JMMlBLSUlOVENBMDEuQU1FLkdCTF9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3J0MFYGCCsGAQUFBzAChkpodHRwOi8vY3JsMi5hbWUuZ2JsL2FpYS9CTDJQS0lJTlRDQTAxLkFNRS5HQkxfQU1FJTIwSW5mcmElMjBDQSUyMDAyKDQpLmNydDBWBggrBgEFBQcwAoZKaHR0cDovL2NybDMuYW1lLmdibC9haWEvQkwyUEtJSU5UQ0EwMS5BTUUuR0JMX0FNRSUyMEluZnJhJTIwQ0ElMjAwMig0KS5jcnQwVgYIKwYBBQUHMAKGSmh0dHA6Ly9jcmw0LmFtZS5nYmwvYWlhL0JMMlBLSUlOVENBMDEuQU1FLkdCTF9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3J0MB0GA1UdDgQWBBRG96ol681QhZp5pSqJ6oYOZNt0GzAOBgNVHQ8BAf8EBAMCBaAwggE1BgNVHR8EggEsMIIBKDCCASSgggEgoIIBHIZCaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraWluZnJhL0NSTC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JshjRodHRwOi8vY3JsMS5hbWUuZ2JsL2NybC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JshjRodHRwOi8vY3JsMi5hbWUuZ2JsL2NybC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JshjRodHRwOi8vY3JsMy5hbWUuZ2JsL2NybC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JshjRodHRwOi8vY3JsNC5hbWUuZ2JsL2NybC9BTUUlMjBJbmZyYSUyMENBJTIwMDIoNCkuY3JsMBcGA1UdIAQQMA4wDAYKKwYBBAGCN3sBATAfBgNVHSMEGDAWgBSuecJrXSWIEwb2BwnDl3x7l48dVTAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBAKKyAgJAkf6JZxLet4ea9iH2HJ_f1HvcVdJfcdpi8oDbTqA74VfwpfgAuboGp1Dxfz5bVflauzzjt_qdGY2Mg3AZsW1CF9KsffviftutQ_em6LBVWyYMbvf4BPcAJ1PLSwjAELsRMysZocC5gvDWrgMvFA1SfAq6khqAbIeAPqd0aTddcHAtS-LceawwUGup6SNsK_yHwLiu7_qR-0RSxvj5lJfViUuKZKrCJAoMZDMAH2C_4HnZPYptyGijrbSTn5A3Whoc6TOM1Mmw7-zZODT8RjZ62a_2hMS8at50D_uAtvTgOjZZyP6f3q5eIREJU-8uer5Rlmz97XHtmEJGoiY&s=NDY0C_DcpVE8-I2dKoE5zD0AfSesr1LzToWthO24qiigY2UuFiYXbMWndggX3EVDxeHkAcJzDE_l28UuLbojMR35-DhbbYjQpkbytYQHxIe2xsEoyjRvLGhuUoACcJEG14qHGpseUp5Jm8gTqTeL3wip_IdqYgqXrbnP2Xw2TqYcrzeA-r5sQlbK1To9XWsQq0jcLn-FkBkiGIdihq2vde2Lqfn2UZr8rP3u4D5322T5fp3nBr3AAhw1T_Re5f4YhLyHBTHAWvYwrxwUBAQpwCLfpJLosjROm1s_790ZMQDlielzmC5GYOkERoYclZLfeokzgbUE036hh13KfdmW_Q&h=zEcXL9wLK67dyeNM-UXelquBxR76Bo_dlxkj3AHhgAU HTTP/1.1" 200 629
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies:     'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies:     'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies:     'Content-Length': '629'
DEBUG: cli.azure.cli.core.sdk.policies:     'Content-Type': 'application/json; charset=utf-8'
DEBUG: cli.azure.cli.core.sdk.policies:     'Expires': '-1'
DEBUG: cli.azure.cli.core.sdk.policies:     'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
DEBUG: cli.azure.cli.core.sdk.policies:     'mise-correlation-id': 'ec31e8d7-9b05-40a0-8dad-5a78378092d4'
DEBUG: cli.azure.cli.core.sdk.policies:     'X-ServiceFabricRequestId': '5a7aaeb2-b6c1-4a59-bf90-4374ef27bd53'
DEBUG: cli.azure.cli.core.sdk.policies:     'x-ms-request-id': '9d370f5b-fbbb-4348-a323-08a29eea52b2'
DEBUG: cli.azure.cli.core.sdk.policies:     'X-Content-Type-Options': 'nosniff'
DEBUG: cli.azure.cli.core.sdk.policies:     'Server': 'Kestrel'
DEBUG: cli.azure.cli.core.sdk.policies:     'x-ms-ratelimit-remaining-subscription-reads': '11983'
DEBUG: cli.azure.cli.core.sdk.policies:     'x-ms-correlation-request-id': 'd2f4f4e2-556b-4eee-96c7-1b52b395ab8a'
DEBUG: cli.azure.cli.core.sdk.policies:     'x-ms-routing-request-id': 'FRANCESOUTH:20240322T112954Z:d2f4f4e2-556b-4eee-96c7-1b52b395ab8a'
DEBUG: cli.azure.cli.core.sdk.policies:     'Date': 'Fri, 22 Mar 2024 11:29:53 GMT'
DEBUG: cli.azure.cli.core.sdk.policies: Response content:
DEBUG: cli.azure.cli.core.sdk.policies: {"id":"/subscriptions/925e5637-72f0-4620-888f-ea47897a8021/resourceGroups/ENVIRONMENT-WE-ResourceGroup/providers/Microsoft.StorageSync/storageSyncServices/ENVIRONMENT-WE-INTEGRATION-STORAGE-SYNC/workflow/7c9518dc-7f47-4f89-9277-94c4df86d83a/operationresults/d3ef7bbe-df42-474f-ab5f-f5ee0f995f6c","name":"d3ef7bbe-df42-474f-ab5f-f5ee0f995f6c","status":"Failed","startTime":"2024-03-22T11:21:49.2896681Z","endTime":"2024-03-22T11:29:25.0693594Z","error":{"code":"MgmtStorageAccountAuthorizationFailed","message":"Unable to read specified storage account. Please check the permissions and try again after some time."}}
DEBUG: cli.azure.cli.core.azclierror: Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/base_polling.py", line 730, in run
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/base_polling.py", line 762, in _poll
azure.core.polling.base_polling.OperationFailed: Operation failed or canceled

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 663, in execute
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 708, in _run_job
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 1013, in __call__
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 1000, in __call__
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/_poller.py", line 242, in result
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/tracing/decorator.py", line 76, in wrapper_use_tracer
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/_poller.py", line 261, in wait
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/_poller.py", line 176, in _start
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/polling/base_polling.py", line 745, in run
azure.core.exceptions.HttpResponseError: (MgmtStorageAccountAuthorizationFailed) Unable to read specified storage account. Please check the permissions and try again after some time.
Code: MgmtStorageAccountAuthorizationFailed
Message: Unable to read specified storage account. Please check the permissions and try again after some time.

ERROR: cli.azure.cli.core.azclierror: (MgmtStorageAccountAuthorizationFailed) Unable to read specified storage account. Please check the permissions and try again after some time.
Code: MgmtStorageAccountAuthorizationFailed
Message: Unable to read specified storage account. Please check the permissions and try again after some time.
ERROR: az_command_data_logger: (MgmtStorageAccountAuthorizationFailed) Unable to read specified storage account. Please check the permissions and try again after some time.
Code: MgmtStorageAccountAuthorizationFailed
Message: Unable to read specified storage account. Please check the permissions and try again after some time.
DEBUG: cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x000001CCDED3A480>]
INFO: az_command_data_logger: exit code: 1
INFO: cli.__main__: Command ran in 487.171 seconds (init: 0.232, invoke: 486.939)
INFO: telemetry.main: Begin splitting cli events and extra events, total events: 1
INFO: telemetry.client: Accumulated 0 events. Flush the clients.
INFO: telemetry.main: Finish splitting cli events and extra events, cli events: 1
INFO: telemetry.save: Save telemetry record of length 3942 in cache
INFO: telemetry.main: Begin creating telemetry upload process.
INFO: telemetry.process: Creating upload process: "C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure\cli\telemetry\__init__.pyc C:\Users\user\.azure"
INFO: telemetry.process: Return from creating process
INFO: telemetry.main: Finish creating telemetry upload process.

Expected behavior

Sync cloud endpoint should be created.

Environment Summary

azure-cli 2.56.0 *

core 2.56.0 * telemetry 1.1.0

Extensions: application-insights 1.2.0 automation 1.0.0b1 ssh 2.0.2 storagesync 1.0.0

Dependencies: msal 1.24.0b2 azure-mgmt-resource 23.1.0b2

Additional context

No response

Azure / azure-cli