ResourceGroupNotFound handled incorrectly by Invoke-AzVMRunCommand and others

## Description

When a _non-subscription owner_ makes a typo in their `-ResourceGroupName` parameter, they get the following error (inviting them down a rabbit-hole of inspecting roles and permissions):

> The client [...] does not have authorization to perform action '**Microsoft.Compute/virtualMachines/runCommand/action**' over scope [subscriptions/validSubscriptionName/resourceGroups/**group_name_with_some_subtle_typo**/providers/Microsoft.Compute/virtualMachines/validVMName] or the scope is invalid. If access was recently granted, please refresh your credentials.
> ErrorCode: AuthorizationFailed

But if the exact same typo is made by a subscription owner, they get the following much more helpful error:

> Invoke-AzVMRunCommand : Resource group 'group_name_with_some_subtle_typo' could not be found.
> ErrorCode: ResourceGroupNotFound

My team lost a solid week going back and forth with the active directory team thinking the "Virtual Machine Contributor" role wasn't getting properly applied before a subscription owner was roped in and tried the command themselves, yielding the latter much more informative error message.

## Steps to reproduce

Invoke a simple command such as follows, but where the 'resourceGroupNamee' provided is non-existant.

```powershell
Invoke-AzVMRunCommand -ResourceGroupName 'resourceGroupNamee' `
-VMName 'someValidVMName' `
-CommandId 'RunPowerShellScript' `
-ScriptPath .\someValidPath.ps1
```
If you are a subscription owner, you should see a helpful error message as above, but in a more restricted setting, you'll get something suggesting that you are lacking `'Microsoft.Compute/virtualMachines/runCommand/action'` permissions (normally granted via the 'VirtualMachineContributor' role as per the documentation)"

## Environment data

```
Name Value
---- -----
PSVersion 5.1.17763.1007
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17763.1007
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```

## Module versions

```powershell
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 1.8.1 Az.Accounts {Disable-AzDataCollection, Disable-AzContextAutosave, Enab...
Script 1.1.1 Az.Advisor {Get-AzAdvisorRecommendation, Enable-AzAdvisorRecommendati...
Script 1.1.1 Az.Aks {Get-AzAks, New-AzAks, Remove-AzAks, Import-AzAksCredentia...
Script 1.1.3 Az.AnalysisServices {Resume-AzAnalysisServicesServer, Suspend-AzAnalysisServic...
Script 2.0.1 Az.ApiManagement {Add-AzApiManagementApiToProduct, Add-AzApiManagementProdu...
Script 1.1.0 Az.ApplicationInsights {Get-AzApplicationInsights, New-AzApplicationInsights, Rem...
Script 1.3.6 Az.Automation {Get-AzAutomationHybridWorkerGroup, Remove-AzAutomationHyb...
Script 3.0.0 Az.Batch {Remove-AzBatchAccount, Get-AzBatchAccount, Get-AzBatchAcc...
Script 1.0.3 Az.Billing {Get-AzBillingInvoice, Get-AzBillingPeriod, Get-AzEnrollme...
Script 1.4.3 Az.Cdn {Get-AzCdnProfile, Get-AzCdnProfileSsoUrl, New-AzCdnProfil...
Script 1.4.0 Az.CognitiveServices {Get-AzCognitiveServicesAccount, Get-AzCognitiveServicesAc...
Script 4.1.0 Az.Compute {Remove-AzAvailabilitySet, Get-AzAvailabilitySet, New-AzAv...
Script 1.0.3 Az.ContainerInstance {New-AzContainerGroup, Get-AzContainerGroup, Remove-AzCont...
Script 1.1.1 Az.ContainerRegistry {New-AzContainerRegistry, Get-AzContainerRegistry, Update-...
Script 1.1.0 Az.DataBoxEdge {Get-AzDataBoxEdgeJob, Get-AzDataBoxEdgeDevice, Invoke-AzD...
Script 1.8.1 Az.DataFactory {Set-AzDataFactoryV2, Update-AzDataFactoryV2, Get-AzDataFa...
Script 1.0.2 Az.DataLakeAnalytics {Get-AzDataLakeAnalyticsDataSource, New-AzDataLakeAnalytic...
Script 1.2.8 Az.DataLakeStore {Get-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeSt...
Script 1.0.0 Az.DataShare {New-AzDataShareAccount, Get-AzDataShareAccount, Remove-Az...
Script 1.1.0 Az.DeploymentManager {Get-AzDeploymentManagerArtifactSource, New-AzDeploymentMa...
Script 1.0.0 Az.DesktopVirtualization {Disconnect-AzWvdUserSession, Get-AzWvdApplication, Get-Az...
Script 1.0.2 Az.DevTestLabs {Get-AzDtlAllowedVMSizesPolicy, Get-AzDtlAutoShutdownPolic...
Script 1.1.2 Az.Dns {Get-AzDnsRecordSet, New-AzDnsRecordConfig, Remove-AzDnsRe...
Script 1.2.3 Az.EventGrid {New-AzEventGridTopic, Get-AzEventGridTopic, Set-AzEventGr...
Script 1.4.3 Az.EventHub {New-AzEventHubNamespace, Get-AzEventHubNamespace, Set-AzE...
Script 1.5.0 Az.FrontDoor {New-AzFrontDoor, Get-AzFrontDoor, Set-AzFrontDoor, Remove...
Script 1.0.0 Az.Functions {Get-AzFunctionApp, Get-AzFunctionAppAvailableLocation, Ge...
Script 3.2.0 Az.HDInsight {Get-AzHDInsightJob, New-AzHDInsightSqoopJobDefinition, Wa...
Script 1.0.2 Az.HealthcareApis {New-AzHealthcareApisService, Remove-AzHealthcareApisServi...
Script 2.5.0 Az.IotHub {Add-AzIotHubKey, Get-AzIotHubEventHubConsumerGroup, Get-A...
Script 2.0.0 Az.KeyVault {Add-AzKeyVaultCertificate, Update-AzKeyVaultCertificate, ...
Script 1.3.2 Az.LogicApp {Get-AzIntegrationAccountAgreement, Get-AzIntegrationAccou...
Script 1.1.3 Az.MachineLearning {Move-AzMlCommitmentAssociation, Get-AzMlCommitmentAssocia...
Script 1.0.0 Az.Maintenance {Get-AzApplyUpdate, Get-AzConfigurationAssignment, Get-AzM...
Script 1.0.2 Az.ManagedServices {Get-AzManagedServicesAssignment, New-AzManagedServicesAss...
Script 1.0.2 Az.MarketplaceOrdering {Get-AzMarketplaceTerms, Set-AzMarketplaceTerms}
Script 1.1.1 Az.Media {Sync-AzMediaServiceStorageKey, Set-AzMediaServiceKey, Get...
Script 2.0.0 Az.Monitor {Get-AzMetricDefinition, Get-AzMetric, Remove-AzLogProfile...
Script 3.0.0 Az.Network {Add-AzApplicationGatewayAuthenticationCertificate, Get-Az...
Script 1.1.1 Az.NotificationHubs {Get-AzNotificationHub, Get-AzNotificationHubAuthorization...
Script 2.1.0 Az.OperationalInsights {New-AzOperationalInsightsAzureActivityLogDataSource, New-...
Script 1.3.1 Az.PolicyInsights {Get-AzPolicyEvent, Get-AzPolicyState, Get-AzPolicyStateSu...
Script 1.1.2 Az.PowerBIEmbedded {Remove-AzPowerBIWorkspaceCollection, Get-AzPowerBIWorkspa...
Script 1.0.3 Az.PrivateDns {Get-AzPrivateDnsZone, Remove-AzPrivateDnsZone, Set-AzPriv...
Script 2.9.1 Az.RecoveryServices {Get-AzRecoveryServicesBackupProperty, Get-AzRecoveryServi...
Script 1.2.1 Az.RedisCache {Remove-AzRedisCachePatchSchedule, New-AzRedisCacheSchedul...
Script 1.0.3 Az.Relay {New-AzRelayNamespace, Get-AzRelayNamespace, Set-AzRelayNa...
Script 2.1.0 Az.Resources {Get-AzProviderOperation, Remove-AzRoleAssignment, Get-AzR...
Script 1.4.1 Az.ServiceBus {New-AzServiceBusNamespace, Get-AzServiceBusNamespace, Set...
Script 2.1.0 Az.ServiceFabric {Add-AzServiceFabricClientCertificate, Add-AzServiceFabric...
Script 1.1.1 Az.SignalR {New-AzSignalR, Get-AzSignalR, Get-AzSignalRKey, New-AzSig...
Script 2.7.0 Az.Sql {Get-AzSqlDatabaseTransparentDataEncryption, Get-AzSqlData...
Script 1.1.0 Az.SqlVirtualMachine {New-AzSqlVM, Get-AzSqlVM, Update-AzSqlVM, Remove-AzSqlVM...}
Script 2.1.0 Az.Storage {Get-AzStorageAccount, Get-AzStorageAccountKey, New-AzStor...
Script 1.2.3 Az.StorageSync {Invoke-AzStorageSyncCompatibilityCheck, New-AzStorageSync...
Script 1.0.1 Az.StreamAnalytics {Get-AzStreamAnalyticsFunction, Get-AzStreamAnalyticsDefau...
Script 1.0.0 Az.Support {Get-AzSupportService, Get-AzSupportProblemClassification,...
Script 1.0.4 Az.TrafficManager {Add-AzTrafficManagerCustomHeaderToEndpoint, Remove-AzTraf...
Script 1.9.0 Az.Websites {Get-AzAppServicePlan, Set-AzAppServicePlan, New-AzAppServ...
Script 5.1.2 Azure {Get-AzureAutomationCertificate, Get-AzureAutomationConnec...
S
```

## Debug output

```
PS H:\> Invoke-AzVMRunCommand -ResourceGroupName 'asdf-typo' `
>> -VMName 'someValidVM' `
>> -CommandId 'RunPowerShellScript' `
>> -ScriptPath .\HelloWorld.ps1
DEBUG: 5:32:55 PM - InvokeAzureRmVMRunCommand begin processing with ParameterSet 'DefaultParameter'.
DEBUG: 5:32:55 PM - using account id 'alain@someorganization.com'...
DEBUG: [Common.Authentication]: Authenticating using Account: 'alain@someorganization.com', environment: 'AzureCloud', tenant: '4db6f928-bfb9-43eb-8104-6b85a431cd6b'
DEBUG: [Common.Authentication]: Authenticating using configuration values: Domain: '4db6f928-bfb9-43eb-8104-6b85a431cd6b', Endpoint: 'https://login.microsoftonline.com/', ClientId: '1950a258-227b-4e31-a9cf-717495945fc2', ClientRedirect:
'urn:ietf:wg:oauth:2.0:oob', ResourceClientUri: 'https://management.core.windows.net/', ValidateAuthority: 'True'
DEBUG: [Common.Authentication]: Acquiring token using context with Authority 'https://login.microsoftonline.com/4db6f928-bfb9-43eb-8104-6b85a431cd6b/', CorrelationId: '00000000-0000-0000-0000-000000000000', ValidateAuthority: 'True'
DEBUG: [Common.Authentication]: Acquiring token using AdalConfiguration with Domain: '4db6f928-bfb9-43eb-8104-6b85a431cd6b', AdEndpoint: 'https://login.microsoftonline.com/', ClientId: '1950a258-227b-4e31-a9cf-717495945fc2', ClientRedirectUri:
urn:ietf:wg:oauth:2.0:oob
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2659965Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: ADAL PCL.Desktop with assembly version '3.19.2.6005', file version '3.19.50302.0130' and informational version
'2a8bec6c4c76d0c1ef819b55bdc3cda2d2605056' is running...
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2664928Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: ADAL PCL.Desktop with assembly version '3.19.2.6005', file version '3.19.50302.0130' and informational version
'2a8bec6c4c76d0c1ef819b55bdc3cda2d2605056' is running...
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2664928Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: === Token Acquisition started:
CacheType: null
Authentication Target: User
, Authority Host: login.microsoftonline.com
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2664928Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: === Token Acquisition started:
Authority: https://login.microsoftonline.com/4db6f928-bfb9-43eb-8104-6b85a431cd6b/
Resource: https://management.core.windows.net/
ClientId: 1950a258-227b-4e31-a9cf-717495945fc2
CacheType: null
Authentication Target: User

DEBUG: [ADAL]: Verbose: 2020-06-10T20:32:55.2664928Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: Loading from cache.
DEBUG: [ADAL]: Verbose: 2020-06-10T20:32:55.2664928Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: Loading from cache.
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2669884Z: 00000000-0000-0000-0000-000000000000 - LoggerBase.cs: Deserialized 1 items to token cache.
DEBUG: [ADAL]: Verbose: 2020-06-10T20:32:55.2669884Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: Looking up cache for a token...
DEBUG: [ADAL]: Verbose: 2020-06-10T20:32:55.2669884Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: Looking up cache for a token...
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2669884Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: An item matching the requested resource was found in the cache
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2669884Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: An item matching the requested resource was found in the cache
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2669884Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: 58.4271501933333 minutes left until token in cache expires
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2669884Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: 58.4271501933333 minutes left until token in cache expires
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2669884Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: A matching item (access token or refresh token or both) was found in the cache
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2669884Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: A matching item (access token or refresh token or both) was found in the cache
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2674843Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: === Token Acquisition finished successfully. An access token was returned: Expiration Time: 2020-06-10 9:31:20 PM +00:00
DEBUG: [ADAL]: Information: 2020-06-10T20:32:55.2674843Z: cea0752b-cebb-47a5-b7b6-0b6ba4c23888 - LoggerBase.cs: === Token Acquisition finished successfully. An access token was returned: Expiration Time: 2020-06-10 9:31:20 PM +00:00Access Token Hash:
77fM6oGpUVxMzYJDcY0En/x0sbHas0qHEO8OUEjUc3M=
User id: 01234567-fc5c-4309-98e3-67163c341011
DEBUG: [Common.Authentication]: Renewing Token with Type: 'Bearer', Expiry: '06/10/2020 21:31:20 +00:00', MultipleResource? 'True', Tenant: '4db6f928-bfb9-43eb-8104-6b85a431cd6b', UserId: 'alain@someorganization.com'
DEBUG: [Common.Authentication]: User info for token DisplayId: 'alain@someorganization.com', Name: Alain Bryden, IdProvider: 'https://sts.windows.net/4db6f928-bfb9-43eb-8104-6b85a431cd6b/', Uid: '01234567-fc5c-4309-98e3-67163c341011'
DEBUG: [Common.Authentication]: Checking token expiration, token expires '06/10/2020 21:31:20 +00:00' Comparing to '06/10/2020 20:32:55 +00:00' With threshold '00:05:00', calculated time until token expiry: '00:58:25.6245473'
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://management.azure.com/subscriptions/eadbeef-dead-beef-dead-beef00000075/resourceGroups/asdf-typo/providers/Microsoft.Compute/virtualMachines/someValidVM/runCommand?api-version=2019-12-01

Headers:
x-ms-client-request-id : 3a55f250-a69a-4f45-8e61-f358ddbbf7ee
accept-language : en-US

Body:
{
"commandId": "RunPowerShellScript",
"script": [
"Write-Host 'Hello, World!'"
]
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Forbidden

Headers:
Pragma : no-cache
x-ms-failure-cause : gateway
x-ms-request-id : c7da18ed-9d9c-422e-9037-8c25f376c670
x-ms-correlation-request-id : c7da18ed-9d9c-422e-9037-8c25f376c670
x-ms-routing-request-id : WESTEUROPE:20200610T203256Z:c7da18ed-9d9c-422e-9037-8c25f376c670
Strict-Transport-Security : max-age=31536000; includeSubDomains
X-Content-Type-Options : nosniff
Connection : close
Cache-Control : no-cache
Date : Wed, 10 Jun 2020 20:32:55 GMT

Body:
{
"error": {
"code": "AuthorizationFailed",
"message": "The client 'alain@someorganization.com' with object id '01234567-fc5c-4309-98e3-67163c341011' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/runCommand/action' over scope
'/subscriptions/eadbeef-dead-beef-dead-beef00000075/resourceGroups/asdf-typo/providers/Microsoft.Compute/virtualMachines/someValidVM' or the scope is invalid. If access was recently granted, please refresh your credentials."
}
}

DEBUG: AzureQoSEvent: CommandName - Invoke-AzVMRunCommand; IsSuccess - True; Duration - 00:00:01.0610638;
DEBUG: Finish sending metric.
DEBUG: 5:32:57 PM - InvokeAzureRmVMRunCommand end processing.
Invoke-AzVMRunCommand : The client 'alain@someorganization.com' with object id '01234567-fc5c-4309-98e3-67163c341011' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/runCommand/action' over scope
'/subscriptions/eadbeef-dead-beef-dead-beef00000075/resourceGroups/asdf-typo/providers/Microsoft.Compute/virtualMachines/someValidVM' or the scope is invalid. If access was recently granted, please refresh your credentials.
ErrorCode: AuthorizationFailed
ErrorMessage: The client 'alain@someorganization.com' with object id '01234567-fc5c-4309-98e3-67163c341011' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/runCommand/action' over scope
'/subscriptions/eadbeef-dead-beef-dead-beef00000075/resourceGroups/asdf-typo/providers/Microsoft.Compute/virtualMachines/someValidVM' or the scope is invalid. If access was recently granted, please refresh your credentials.
ErrorTarget:
StatusCode: 403
ReasonPhrase: Forbidden
OperationID : c7da18ed-9d9c-422e-9037-8c25f376c670
At line:1 char:1
+ Invoke-AzVMRunCommand -ResourceGroupName 'asdf-typo' `
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Invoke-AzVMRunCommand], ComputeCloudException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Compute.Automation.InvokeAzureRmVMRunCommand

DEBUG: AzureQoSEvent: CommandName - Invoke-AzVMRunCommand; IsSuccess - False; Duration - 00:00:01.0610638;; Exception - Microsoft.Azure.Commands.Compute.Common.ComputeCloudException: The client 'alain@someorganization.com' with object id
'01234567-fc5c-4309-98e3-67163c341011' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/runCommand/action' over scope
'/subscriptions/eadbeef-dead-beef-dead-beef00000075/resourceGroups/asdf-typo/providers/Microsoft.Compute/virtualMachines/someValidVM' or the scope is invalid. If access was recently granted, please refresh your credentials.
ErrorCode: AuthorizationFailed
ErrorMessage: The client 'alain@someorganization.com' with object id '01234567-fc5c-4309-98e3-67163c341011' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/runCommand/action' over scope
'/subscriptions/eadbeef-dead-beef-dead-beef00000075/resourceGroups/asdf-typo/providers/Microsoft.Compute/virtualMachines/someValidVM' or the scope is invalid. If access was recently granted, please refresh your credentials.
ErrorTarget:
StatusCode: 403
ReasonPhrase: Forbidden
OperationID : c7da18ed-9d9c-422e-9037-8c25f376c670 ---> Microsoft.Rest.Azure.CloudException: The client 'alain@someorganization.com' with object id '01234567-fc5c-4309-98e3-67163c341011' does not have authorization to perform action
'Microsoft.Compute/virtualMachines/runCommand/action' over scope '/subscriptions/eadbeef-dead-beef-dead-beef00000075/resourceGroups/asdf-typo/providers/Microsoft.Compute/virtualMachines/someValidVM' or the scope is invalid. If access was recently
granted, please refresh your credentials.
at Microsoft.Azure.Management.Compute.VirtualMachinesOperations.d__40.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
at Microsoft.Azure.Management.Compute.VirtualMachinesOperations.d__26.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
at Microsoft.Azure.Management.Compute.VirtualMachinesOperationsExtensions.d__43.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
at Microsoft.Azure.Management.Compute.VirtualMachinesOperationsExtensions.RunCommand(IVirtualMachinesOperations operations, String resourceGroupName, String vmName, RunCommandInput parameters)
at Microsoft.Azure.Commands.Compute.Automation.InvokeAzureRmVMRunCommand.b__0_0()
at Microsoft.Azure.Commands.Compute.ComputeClientBaseCmdlet.ExecuteClientAction(Action action)
--- End of inner exception stack trace ---
at Microsoft.Azure.Commands.Compute.ComputeClientBaseCmdlet.ExecuteClientAction(Action action)
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord();
DEBUG: Finish sending metric.
DEBUG: 5:32:59 PM - InvokeAzureRmVMRunCommand end processing.
```

## Error output

```
PS H:\> Resolve-AzError
DEBUG: 5:38:47 PM - ResolveError begin processing with ParameterSet 'AnyErrorParameterSet'.
DEBUG: 5:38:47 PM - using account id 'alain@someorganization.com'...
WARNING: Breaking changes in the cmdlet 'Resolve-AzError' :
WARNING: - The `Resolve-Error` alias will be removed in a future release. Please change any scripts that use this alias to use `Resolve-AzError` instead.

WARNING: NOTE : Go to https://aka.ms/azps-changewarnings for steps to suppress this breaking change warning, and other information on breaking changes in Azure PowerShell.

HistoryId: 10

RequestId :
Message : The client 'alain@someorganization.com' with object id '01234567-fc5c-4309-98e3-67163c341011' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/runCommand/action' over scope
'/subscriptions/deadbeef-dead-beef-dead-beef00000075/resourceGroups/asdf-typo/providers/Microsoft.Compute/virtualMachines/someValidVM' or the scope is invalid. If access was recently granted, please refresh your credentials.
ErrorCode: AuthorizationFailed
ErrorMessage: The client 'alain@someorganization.com' with object id '01234567-fc5c-4309-98e3-67163c341011' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/runCommand/action' over scope
'/subscriptions/deadbeef-dead-beef-dead-beef00000075/resourceGroups/asdf-typo/providers/Microsoft.Compute/virtualMachines/someValidVM' or the scope is invalid. If access was recently granted, please refresh your credentials.
ErrorTarget:
StatusCode: 403
ReasonPhrase: Forbidden
OperationID : c7da18ed-9d9c-422e-9037-8c25f376c670
ServerMessage :
ServerResponse :
RequestMessage :
InvocationInfo : {Invoke-AzVMRunCommand}
Line : Invoke-AzVMRunCommand -ResourceGroupName 'asdf-typo' `

Position : At line:1 char:1
+ Invoke-AzVMRunCommand -ResourceGroupName 'asdf-typo' `
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
StackTrace : at Microsoft.Azure.Commands.Compute.ComputeClientBaseCmdlet.ExecuteClientAction(Action action)
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
HistoryId : 10

The Azure PowerShell team is listening, please let us know how we are doing: https://aka.ms/azpssurvey?Q_CHL=ERROR.

DEBUG: AzureQoSEvent: CommandName - Resolve-AzError; IsSuccess - True; Duration - 00:00:00.2029767;
DEBUG: Finish sending metric.
DEBUG: 5:38:49 PM - ResolveError end processing.
```

## Closing Remarks

I imagine that the presence of the string "or the scope is invalid" was meant to account for the possibility of a bad resource name - but I would suggest that these two cases should be handled separately (i.e. with different messages and error codes) as is clearly done in the 'subscription owner' case.

Acknowledging that there may be information security issues with confirming or denying whether a resource group name is valid to someone not permissioned at the subscription level - I feel like there could be a happy medium, such as:

> Invoke-AzVMRunCommand : Resource group 'group_name_with_some_subtle_typo' does not exist, or you do not have read access to it.
> ErrorCode: ResourceGroupNotFound

Although I see no reason why the same message given to subscription-owners can't be given to everyone - since it simply claims the name cannot be found - not whether or not it exists.

Note also that I've seen this same problem affect several other commands (such as `Get-AzureRmVM`) - so it likely needs to be solved as part of some shared logic for resolving Resource Group Names.

Thanks for reading,
Alain