Azure / azure-cli

Azure Command-Line Interface
MIT License
4.02k stars 2.99k forks source link

”az webapp deploy“ requires additional "Microsoft.Web/Serverfarms/read" permission since version 2.59.0, which is unexpected #28978

Open kevin808 opened 5 months ago

kevin808 commented 5 months ago

Describe the bug

It is not expected for the app service deployment to require additional permission for "Microsoft.Web/Serverfarms/read". image

When run the same command prior to version 2.59.0, there is no issues. image

Related command

az webapp deploy --resource-group APP --name xxx --src-path .\package.zip --type zip --async true

Errors

The client 'xxx' with object id 'xxx' does not have authorization to perform action 'Microsoft.Web/serverfarms/read' over scope '/subscriptions/xxx/resourceGroups/APP/providers/Microsoft.Web/serverfarms/LinuxPlan' or the scope is invalid. If access was recently granted, please refresh your credentials. Code: AuthorizationFailed

Issue script & Debug output

N/A

Expected behavior

The deployment should go without issues

Environment Summary

PS D:\demo\sql-nodejs> az --version azure-cli 2.60.0

core 2.60.0 telemetry 1.1.0

Extensions: serviceconnector-passwordless 1.0.2 spring 1.20.1

Dependencies: msal 1.28.0 azure-mgmt-resource 23.1.0b2

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe' Extensions directory 'C:\Users\lkevi.azure\cliextensions'

Python (Windows) 3.11.8 (tags/v3.11.8:db85d51, Feb 6 2024, 21:52:07) [MSC v.1937 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

yonzhan commented 5 months ago

Thank you for opening this issue, we will look into it.

microsoft-github-policy-service[bot] commented 5 months ago

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @AzureAppServiceCLI, @antcp.