Azure / Azure/azure-cli

RBAC assignment on AD group failing

Open
#22,208 6 comments 6 reactions 1 assignee Claimed by @jiasli View on GitHub
act-identity-squad Auto-Assign customer-reported Graph RBAC Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

> ### `az feedback` auto-generates most of the information requested below, as of CLI version 2.0.62

**Describe the bug**
When an AD group is created and a role is assigned quickly afterwards, the role assignment fails. The command returns the message
```
Check that you have the correct principal ID. If you are creating this principal and then immediately assigning a role, this error might be related to a replication delay. In this case, set the role assignment principalType property to a value, such as ServicePrincipal, User, or Group. See https://aka.ms/docs-principaltype
```
However, setting the principalType does not help. For example:
```
az role assignment create --role Reader --assignee-object-id --assignee-principal-type Group --resource-group rg-prod-services --subscription
```
results in:
```
WARNING: The underlying Active Directory Graph API will be replaced by Microsoft Graph API in a future version of Azure CLI. Please carefully review all breaking changes introduced during this migration: https://docs.microsoft.com/cli/azure/microsoft-graph-migration
Principal does not exist in the directory . Check that you have the correct principal ID. If you are creating this principal and then immediately assigning a role, this error might be related to a replication delay. In this case, set the role assignment principalType property to a value, such as ServicePrincipal, User, or Group. See https://aka.ms/docs-principaltype
```
If the command to assign a role is repeated a few minutes after the AD group has been created it works without issue.

**To Reproduce**
Create an AD group and then try to assign a role to it quickly afterwards.

**Expected behavior**
Ideally, the role assignment command should not fail.

**Environment summary**
```
$ az --version
WARNING: You have 2 updates available. Consider updating your CLI installation with 'az upgrade'

Please let us know how we are doing: https://aka.ms/azureclihats
and let us know if you're interested in trying out our newest features: https://aka.ms/CLIUXstudy
azure-cli 2.34.1 *

core 2.34.1 *
telemetry 1.0.6

Extensions:
account 0.2.2
azure-devops 0.23.0
db-up 0.2.6

Dependencies:
msal 1.16.0
azure-mgmt-resource 20.0.0

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\....user...\.azure\cliextensions'

Python (Windows) 3.8.9 (tags/v3.8.9:a743f81, Apr 6 2021, 13:22:56) [MSC v.1928 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal
```
Using Bash on Windows.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.