Contributor Function Deploy Failure

[EvanOman]

Not sure if this is a bug or not, looking forward to getting some feedback.

Summary

I have "Contributor" access to an Azure Function App but I am unable to deploy using gradlew.bat azureFunctionsDeploy.

Steps to Reproduce

Create a Function App, add a user as a "Contributor", and try to deploy as that user.

Expected Results

gradlew.bat azureFunctionsDeploy should be able to run successfully with those permissions (I have done so successfully with a Python Function App). I can also deploy the app as the user which created the Java Function App.

Actual Results:

I get the following error:

Status code 403, {"error":{"code":"AuthorizationFailed","message":"The client '<ME>' with object id '<MY-ID>' does not have authorization to perform action 'Microsoft.Web/serverfarms/read' over scope '/subscriptions/<APP-SUB>/resourceGroups/<APP-RG>/providers/Microsoft.Web/serverfarms/<APP-SERVICE-PLAN>' or the scope is invalid. If access was recently granted, please refresh your credentials."}}

Additional Info

• I can deploy the app if I add the user as a "Contributor" to the App Service Plan
• I can provide the code if that is useful

[andxu]

hi @EvanOman, thank you for using our tools. Can you give me the function configuration in build.gradle(you can mask the sensitive field like the name)?

[EvanOman]

Thanks @andxu for the response, here is the function configuration (very vanilla):

azurefunctions {
    allowTelemetry = false
    subscription = '<SUBSCRIPTION_ID>'
    resourceGroup = '<RESOURCE_GROUP>'
    appName = '<APP_NAME>'
    runtime {
        os = 'windows'
        javaVersion = '8'
    }
    localDebug = "transport=dt_socket,server=y,suspend=n,address=5005"
}

Again, I was able to deploy with the same config after I was given "Contributor" permissions to the App Service Plan, a step not required for the Python Azure Functions.

[andxu]

This is a role assignment question, can you try to assign contributor+ permission on resource group level?

[andxu]

Close this issue since no response