ERROR: TF400813: The user 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa' is not authorized to access this resource.

[arindam0310018]

Hello Team,

I am trying to create DevOps Service Connection (Type AzureRM) using Azure DevOps Pipelines.
When I am Creating manually running commands using Powershell, it works. But when I am putting it as a Powershell Pipeline Task (In line Script), it throws the below Error:-
ERROR: TF400813: The user 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa' is not authorized to access this resource.

Here goes the below details:-

1. Commands which I ran manually and is successfully Executed -

---

az devops login
(Will ask for PAT Token)

az devops configure --defaults organization= project=

$passwd="Enter Service Principal Secret"

$env:AZURE_DEVOPS_EXT_AZURE_RM_SERVICE_PRINCIPAL_KEY=$passwd

az devops service-endpoint azurerm create --azure-rm-service-principal-id --azure-rm-subscription-id --azure-rm-subscription-name --azure-rm-tenant-id --name --org --project

az devops service-endpoint list --output table

$id = az devops service-endpoint list --query "[?name==''].id" -o tsv

az devops service-endpoint update --id $id --enable-for-all

---

2. Powershell Pipeline Task (In line Script) -

---

• task: PowerShell@2
  displayName: CREATE SERVICE CONNECTION IN DEVOPS
  inputs:
  targetType: 'inline'
  script: |
  az devops service-endpoint azurerm create --azure-rm-service-principal-id --azure-rm-subscription-id --azure-rm-subscription-name --azure-rm-tenant-id --name --org --project
  $id = az devops service-endpoint list --query "[?name==''].id" -o tsv
  az devops service-endpoint update --id $id --enable-for-all
  env:
  AZURE_DEVOPS_EXT_AZURE_RM_SERVICE_PRINCIPAL_KEY: "Enter Service Principal Secret"

---

Can you let me know what is the issue here with the pipeline...

Many Thanks
Regards, Arindam Mitra

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: fa18e6e0-743a-1e6f-23a7-26460e2f9f27
• Version Independent ID: f05be940-a104-7cc4-1cd8-88046d3eac49
• Content: az devops service-endpoint azurerm
• Content Source: latest/docs-ref-autogen/devops/service-endpoint/azurerm.yml
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[yonzhan]

route to CXP team

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @v-anvashist, @V-hmusukula.

Issue Details

---

Hello Team,

I am trying to create DevOps Service Connection (Type AzureRM) using Azure DevOps Pipelines.
When I am Creating manually running commands using Powershell, it works. But when I am putting it as a Powershell Pipeline Task (In line Script), it throws the below Error:-
ERROR: TF400813: The user 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa' is not authorized to access this resource.

Here goes the below details:-

1. Commands which I ran manually and is successfully Executed -

---

az devops login
(Will ask for PAT Token)

az devops configure --defaults organization= project=

$passwd="Enter Service Principal Secret"

$env:AZURE_DEVOPS_EXT_AZURE_RM_SERVICE_PRINCIPAL_KEY=$passwd

az devops service-endpoint azurerm create --azure-rm-service-principal-id --azure-rm-subscription-id --azure-rm-subscription-name --azure-rm-tenant-id --name --org --project

az devops service-endpoint list --output table

$id = az devops service-endpoint list --query "[?name==''].id" -o tsv

az devops service-endpoint update --id $id --enable-for-all

---

2. Powershell Pipeline Task (In line Script) -

---

• task: PowerShell@2
  displayName: CREATE SERVICE CONNECTION IN DEVOPS
  inputs:
  targetType: 'inline'
  script: |
  az devops service-endpoint azurerm create --azure-rm-service-principal-id --azure-rm-subscription-id --azure-rm-subscription-name --azure-rm-tenant-id --name --org --project
  $id = az devops service-endpoint list --query "[?name==''].id" -o tsv
  az devops service-endpoint update --id $id --enable-for-all
  env:
  AZURE_DEVOPS_EXT_AZURE_RM_SERVICE_PRINCIPAL_KEY: "Enter Service Principal Secret"

---

Can you let me know what is the issue here with the pipeline...

Many Thanks
Regards, Arindam Mitra

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: fa18e6e0-743a-1e6f-23a7-26460e2f9f27
• Version Independent ID: f05be940-a104-7cc4-1cd8-88046d3eac49
• Content: az devops service-endpoint azurerm
• Content Source: latest/docs-ref-autogen/devops/service-endpoint/azurerm.yml
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

Author:	arindam0310018
Assignees:	-
Labels:	Service Attention, customer-reported, DevOps, Auto-Assign
Milestone:	-

[navba-MSFT]

@arindam0310018 Removing CXP attention label and adding the Service team to assist on Devops issue.

@v-anvashist, @V-hmusukula Could you please look into this and provide an update ? Thanks in advance.

[v-soujanya]

@arindam0310018 Are you facing this issue only in the above-mentioned pipeline task?

[arindam0310018]

Hello @v-soujanya

Yes, I am facing issue with the above mentioned pipeline task.

Below is pipeline Task snippet -

Create Service Connection in Az DevOps:-

- task: PowerShell@2
  displayName: CREATE SERVICE CONNECTION IN DEVOPS
  inputs:
    targetType: 'inline'
    script: |         
     az devops service-endpoint azurerm create --azure-rm-service-principal-id $(${{ parameters.SPINAME }}-id) --azure-rm-subscription-id ${{ parameters.SubscriptionID }} --azure-rm-subscription-name ${{ parameters.SubscriptionName }} --azure-rm-tenant-id ${{ parameters.TenantID }} --name ${{ parameters.SPINAME }} --org $(DevOpsOrganisation) --project $(DevOpsProjName) 
     $id = az devops service-endpoint list --query "[?name=='${{ parameters.SPINAME }}'].id" -o tsv
     az devops service-endpoint update --id $id --enable-for-all
  env: 
    AZURE_DEVOPS_EXT_AZURE_RM_SERVICE_PRINCIPAL_KEY: $(${{ parameters.SPINAME }}-passwd) 

Error Screenshot below:-

Many Thanks
Regards, Arindam Mitra

[v-anvashist]

Hi @arindam0310018 We are suspecting this as permission/PAT token expired issue.

Could you please check are u able to run some another pipelines?

[arindam0310018]

Hello @v-anvashist,
I have tried earlier resetting the PAT. It gives me the same error.
Please note that I have Stored PAT in KV and Fetching as pipeline task.

Many Thanks
Regards, Arindam Mitra

[v-anvashist]

@arindam0310018 Let me conclude some points.

1. You are facing access issue in all the pipelines not only with above mentioned one. Please confirm
2. You are not able to reset your PAT token and same access issue you are facing in PAT resetting. Please confirm

Thanks,
Anjali

[arindam0310018]

Hello @v-anvashist
Thank you for the concluded points. My Answer inline below.

1. I am facing access issue with only this Pipeline.
2. There is no problem in resetting PAT. In order to resolve this current issue, I reset the PAT, update the new PAT to KV and then executed the pipeline. Same issue was encountered.

If it would help to reproduce the issue on your side, happy to share the entire YAML redacting my resource details.
Please let me know

Many Thanks
Regards, Arindam Mitra