Azure Cli - Issue with creating resoucre

[gtedavid]

Describe the bug

When you don't have the permission to read resource groups in a Subscription and only have permission on several resource groups, you can only create through the portal and not through the CLI.

Related command

az storage account create --name mysa01235 --resource-group "rgname" --sku Standard_GRS --kind StorageV2 az vm create --name myvm01235 --image Ubuntu22 --resource-group "RGNAME"

Errors

(AuthorizationFailed) The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions//resourcegroups/' or the scope is invalid. If access was recently granted, please refresh your credentials. Code: AuthorizationFailed Message: The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions//resourcegroups/' or the scope is invalid. If access was recently granted, please refresh your credentials.

Issue script & Debug output

VM cli.knack.cli: Command arguments: ['vm', 'create', '--name', 'myvm01235', '--image', 'Ubuntu22', '--resource-group', 'RGNAME', '--debug'] cli.knack.cli: init debug log: Enable color in terminal. cli.knack.cli: Event: Cli.PreExecute [] cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7f01f2e00160>, <function OutputProducer.on_global_arguments at 0x7f01f2d1ad30>, <function CLIQuery.on_global_arguments at 0x7f01f2cb1310>] cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate [] cli.azure.cli.core: Modules found from index for 'vm': ['azure.cli.command_modules.vm'] cli.azure.cli.core: Loading command modules: cli.azure.cli.core: Name Load Time Groups Commands cli.azure.cli.core: vm 0.279 58 247 cli.azure.cli.core: Total (1) 0.279 58 247 cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_next'] cli.azure.cli.core: Loading extensions: cli.azure.cli.core: Name Load Time Groups Commands Directory cli.azure.cli.core: ai-examples 0.081 1 1 /usr/lib/python3.9/site-packages/azure-cli-extensions/ai-examples cli.azure.cli.core: Total (1) 0.081 1 1
cli.azure.cli.core: Loaded 59 groups, 248 commands. cli.azure.cli.core: Found a match in the command table. cli.azure.cli.core: Raw command : vm create cli.azure.cli.core: Command table: vm create cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7f01f2176280>] cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/USER/.azure/commands/2024-08-28.20-04-06.vm_create.5928.log'. az_command_data_logger: command args: vm create --name {} --image {} --resource-group {} --debug cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x7f01f2113e50>] cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad [] cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x7f01f2139e50>, <function register_cache_arguments..add_cache_arguments at 0x7f01f20d5d30>] cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded [] cli.knack.cli: Event: CommandInvoker.OnPreParseArgs [] cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7f01f2d1adc0>, <function CLIQuery.handle_query_parameter at 0x7f01f2cb13a0>, <function register_ids_argument..parse_ids_arguments at 0x7f01f20d5ca0>] cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ResourceManagementClient urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342 urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2161 msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'} cli.azure.cli.core.auth.adal_authentication: MSIAuthenticationWrapper.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342 urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2161 msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'} cli.azure.cli.core.auth.adal_authentication: Normalize expires_on: '1724879414' -> 1724879414 cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/SUBID/resourcegroups/rg?api-version=2022-09-01' cli.azure.cli.core.sdk.policies: Request method: 'GET' cli.azure.cli.core.sdk.policies: Request headers: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json' cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'ae11f774-6578-11ef-8560-00155d71b24b' cli.azure.cli.core.sdk.policies: 'CommandName': 'vm create' cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--name --image --resource-group --debug' cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.63.0 (RPM) azsdk-python-core/1.28.0 Python/3.9.19 (Linux-5.10.102.2-microsoft-standard-x86_64-with-glibc2.35) cloud-shell/1.0' cli.azure.cli.core.sdk.policies: 'Authorization': '' cli.azure.cli.core.sdk.policies: Request body: cli.azure.cli.core.sdk.policies: This request has no body urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443 urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/SUBID/resourcegroups/RG?api-version=2022-09-01 HTTP/1.1" 403 468 cli.azure.cli.core.sdk.policies: Response status: 403 cli.azure.cli.core.sdk.policies: Response headers: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache' cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache' cli.azure.cli.core.sdk.policies: 'Content-Length': '468' cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8' cli.azure.cli.core.sdk.policies: 'Expires': '-1' cli.azure.cli.core.sdk.policies: 'x-ms-failure-cause': 'gateway' cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '' cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '' cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': '' cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains' cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff' cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE' cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': '' cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 28 Aug 2024 20:04:06 GMT' cli.azure.cli.core.sdk.policies: Response content: cli.azure.cli.core.sdk.policies: {"error":{"code":"AuthorizationFailed","message":"The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/rg' or the scope is invalid. If access was recently granted, please refresh your credentials."}} cli.azure.cli.core.azclierror: Traceback (most recent call last): File "/usr/lib64/az/lib/python3.9/site-packages/knack/invocation.py", line 111, in _validation self._validate_cmd_level(parsed_ns, cmd_validator) File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/init.py", line 888, in _validate_cmd_level cmd_validator(self._build_kwargs(cmd_validator, ns)) File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/command_modules/vm/_validators.py", line 1507, in process_vm_create_namespace _validate_location(cmd, namespace, namespace.zone, namespace.size) File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/command_modules/vm/_validators.py", line 362, in _validate_location get_default_location_from_resource_group(cmd, namespace) File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/validators.py", line 81, in get_default_location_from_resource_group rg = resource_client.resource_groups.get(namespace.resource_group_name) File "/usr/lib64/az/lib/python3.9/site-packages/azure/core/tracing/decorator.py", line 76, in wrapper_use_tracer return func(args, kwargs) File "/usr/lib64/az/lib/python3.9/site-packages/azure/mgmt/resource/resources/v2022_09_01/operations/_operations.py", line 10756, in get raise HttpResponseError(response=response, error_format=ARMErrorFormat) azure.core.exceptions.HttpResponseError: (AuthorizationFailed) The client 'EMAIL' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RGNAme' or the scope is invalid. If access was recently granted, please refresh your credentials. Code: AuthorizationFailed Message: The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials.

cli.azure.cli.core.azclierror: (AuthorizationFailed) The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials. Code: AuthorizationFailed Message: The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials. az_command_data_logger: (AuthorizationFailed) The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials. Code: AuthorizationFailed Message: The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials. cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7f01f21764c0>] az_command_data_logger: exit code: 2 cli.main: Command ran in 1.137 seconds (init: 0.160, invoke: 0.977) telemetry.main: Begin splitting cli events and extra events, total events: 1 telemetry.client: Accumulated 0 events. Flush the clients. telemetry.main: Finish splitting cli events and extra events, cli events: 1 telemetry.save: Save telemetry record of length 4829 in cache telemetry.main: Begin creating telemetry upload process. telemetry.process: Creating upload process: "/usr/bin/python3.9 /usr/lib/az/lib/python3.9/site-packages/azure/cli/telemetry/init.py /home/USER/.azure" telemetry.process: Return from creating process telemetry.main: Finish creating telemetry upload process. SA cli.knack.cli: Command arguments: ['storage', 'account', 'create', '--name', 'mysa01235', '--resource-group', 'RG', '--sku', 'Standard_GRS', '--kind', 'StorageV2', '--debug'] cli.knack.cli: init debug log: Enable color in terminal. cli.knack.cli: Event: Cli.PreExecute [] cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7ff87033b160>, <function OutputProducer.on_global_arguments at 0x7ff870255d30>, <function CLIQuery.on_global_arguments at 0x7ff8701ec310>] cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate [] cli.azure.cli.core: Modules found from index for 'storage': ['azure.cli.command_modules.storage'] cli.azure.cli.core: Loading command modules: cli.azure.cli.core: Name Load Time Groups Commands cli.azure.cli.core: storage 0.245 59 273 cli.azure.cli.core: Total (1) 0.245 59 273 cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_next'] cli.azure.cli.core: Loading extensions: cli.azure.cli.core: Name Load Time Groups Commands Directory cli.azure.cli.core: ai-examples 0.096 1 1 /usr/lib/python3.9/site-packages/azure-cli-extensions/ai-examples cli.azure.cli.core: Total (1) 0.096 1 1
cli.azure.cli.core: Loaded 60 groups, 274 commands. cli.azure.cli.core: Found a match in the command table. cli.azure.cli.core: Raw command : storage account create cli.azure.cli.core: Command table: storage account create cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7ff86f6b1280>] cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/USER/.azure/commands/2024-08-28.20-10-37.storage_account_create.6090.log'. az_command_data_logger: command args: storage account create --name {} --resource-group {} --sku {} --kind {} --debug cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x7ff86f64ee50>] cli.azure.cli.core.profiles._shared: Traceback (most recent call last): File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/profiles/_shared.py", line 660, in _get_attr op = getattr(op, part) AttributeError: module 'azure.mgmt.storage.v2023_05_01.models' has no attribute 'ActiveDirectoryPropertiesAccountType'

cli.azure.cli.core.profiles._shared: Traceback (most recent call last): File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/profiles/_shared.py", line 660, in _get_attr op = getattr(op, part) AttributeError: module 'azure.mgmt.storage.v2023_05_01.models' has no attribute 'ListKeyExpand'

cli.azure.cli.core.profiles._shared: Traceback (most recent call last): File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/profiles/_shared.py", line 660, in _get_attr op = getattr(op, part) AttributeError: module 'azure.mgmt.storage.v2023_05_01.models' has no attribute 'CorsRuleAllowedMethodsItem'

cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad [] cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x7ff86f674e50>, <function register_cache_arguments..add_cache_arguments at 0x7ff86f610d30>] cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded [] cli.knack.cli: Event: CommandInvoker.OnPreParseArgs [] cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7ff870255dc0>, <function CLIQuery.handle_query_parameter at 0x7ff8701ec3a0>, <function register_ids_argument..parse_ids_arguments at 0x7ff86f610ca0>] cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ResourceManagementClient urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342 urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2161 msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'} cli.azure.cli.core.auth.adal_authentication: MSIAuthenticationWrapper.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={} urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342 urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2161 msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'} cli.azure.cli.core.auth.adal_authentication: Normalize expires_on: '1724879414' -> 1724879414 cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/0SUBID/resourcegroups/RG?api-version=2022-09-01' cli.azure.cli.core.sdk.policies: Request method: 'GET' cli.azure.cli.core.sdk.policies: Request headers: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json' cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '974086a4-6579-11ef-ab2e-00155d71b24b' cli.azure.cli.core.sdk.policies: 'CommandName': 'storage account create' cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--name --resource-group --sku --kind --debug' cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.63.0 (RPM) azsdk-python-core/1.28.0 Python/3.9.19 (Linux-5.10.102.2-microsoft-standard-x86_64-with-glibc2.35) cloud-shell/1.0' cli.azure.cli.core.sdk.policies: 'Authorization': '' cli.azure.cli.core.sdk.policies: Request body: cli.azure.cli.core.sdk.policies: This request has no body urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443 urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/0SUBID/resourcegroups/RG?api-version=2022-09-01 HTTP/1.1" 403 468 cli.azure.cli.core.sdk.policies: Response status: 403 cli.azure.cli.core.sdk.policies: Response headers: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache' cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache' cli.azure.cli.core.sdk.policies: 'Content-Length': '468' cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8' cli.azure.cli.core.sdk.policies: 'Expires': '-1' cli.azure.cli.core.sdk.policies: 'x-ms-failure-cause': 'gateway' cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '' cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '' cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': '' cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains' cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff' cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE' cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': '' cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 28 Aug 2024 20:10:38 GMT' cli.azure.cli.core.sdk.policies: Response content: cli.azure.cli.core.sdk.policies: {"error":{"code":"AuthorizationFailed","message":"The client 'EMAIL' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials."}} cli.azure.cli.core.azclierror: Traceback (most recent call last): File "/usr/lib64/az/lib/python3.9/site-packages/knack/invocation.py", line 113, in _validation self._validate_arg_level(parsed_ns) File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/init.py", line 898, in _validate_arg_level validator(self._build_kwargs(validator, ns)) File "/usr/lib64/az/lib/python3.9/site-packages/azure/cli/core/commands/validators.py", line 81, in get_default_location_from_resource_group rg = resource_client.resource_groups.get(namespace.resource_group_name) File "/usr/lib64/az/lib/python3.9/site-packages/azure/core/tracing/decorator.py", line 76, in wrapper_use_tracer return func(args, kwargs) File "/usr/lib64/az/lib/python3.9/site-packages/azure/mgmt/resource/resources/v2022_09_01/operations/_operations.py", line 10756, in get raise HttpResponseError(response=response, error_format=ARMErrorFormat) azure.core.exceptions.HttpResponseError: (AuthorizationFailed) The client 'EMAIL' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials. Code: AuthorizationFailed Message: The client 'EMAIL' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials.

cli.azure.cli.core.azclierror: (AuthorizationFailed) The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials. Code: AuthorizationFailed Message: The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials. az_command_data_logger: (AuthorizationFailed) The client 'email' with object id 'ID' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials. Code: AuthorizationFailed Message: The client 'email' with object id '' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/SUBID/resourcegroups/RG' or the scope is invalid. If access was recently granted, please refresh your credentials. cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7ff86f6b14c0>] az_command_data_logger: exit code: 2 cli.main: Command ran in 1.225 seconds (init: 0.178, invoke: 1.047) telemetry.main: Begin splitting cli events and extra events, total events: 1 telemetry.client: Accumulated 0 events. Flush the clients. telemetry.main: Finish splitting cli events and extra events, cli events: 1 telemetry.save: Save telemetry record of length 4860 in cache telemetry.main: Begin creating telemetry upload process. telemetry.process: Creating upload process: "/usr/bin/python3.9 /usr/lib/az/lib/python3.9/site-packages/azure/cli/telemetry/init.py /home/USER.azure" telemetry.process: Return from creating process telemetry.main: Finish creating telemetry upload process.

Expected behavior

Creating VM Creating SA (like in the Portal)

Environment Summary

azure-cli 2.63.0

core 2.63.0 telemetry 1.1.0

Extensions: ai-examples 0.2.5 ml 2.28.0 ssh 2.0.5

Dependencies: msal 1.30.0 azure-mgmt-resource 23.1.1

Python location '/usr/bin/python3.9' Extensions directory '/home/david_gorgette/.azure/cliextensions' Extensions system directory '/usr/lib/python3.9/site-packages/azure-cli-extensions'

Python (Linux) 3.9.19 (main, Jul 31 2024, 03:47:41) [GCC 11.2.0]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions[bot]]

Here are some similar issues that might help you. Please check if they can solve your problem.

• 27352

[gtedavid]

Permission on the RG

Permission on the subscription