Azure / Azure/azure-powershell

New-AzAppServicePlan cannot create plan for ASE in another subscription

Open
#16,094 4 comments 0 reactions 1 assignee Claimed by @NitashaV View on GitHub
act-observability-squad App Services Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

## Description

Although I understand it should be possible I cannot use the PS1 cmdlet to add a Web App plan in Sub A to a ASE in Sub B - where the user is owner in Sub B (ASE) and has RG Contributor + "Web Plan Contributor" which has "Microsoft.Web/hostingEnvironments/Join/Action" in Sub A (where plan is to be created)

## Steps to reproduce

```powershell

# In context of Sub A - where RG "begim" exists and plan should be created

New-AzAppServicePlan -ResourceGroupName "begim" -Name "begim-we-sub-ase-wap" -Location "uksouth" -Tier "Isolated" -NumberofWorkers 1 -WorkerSize "Small" -AseName "subscriptions//resourceGroups/ase-rg/providers/Microsoft.Web/hostingEnvironments/begimase" -AseResourceGroupName "ase-rg" -debug

```

Gives

Body:
{
"error": {
"code": "LinkedAuthorizationFailed",
"message": "The client 'begim@microsoft.com' with object id 'a2e62ab2-6f11-4259-a85c-ff673d5e30e8' has permission to perform action 'Microsoft.Web/serverfarms/write' on scope '/subscriptions//resourceGroups/begim/providers/Microsoft.Web/serverfarms/begim-we-sub-ase-wap'; however, it does not have permission to perform action 'Microsoft.Web/hostingEnvironments/join/action' on the linked scope(s) '/subscriptions/bb399662-54b9-4780-af25-084a0031fd81/resourcegroups/ase-rg/providers/Microsoft.Web/hostingEnvironments/subscriptions//resourceGroups/ase-rg/providers/Microsoft.Web/hostingEnvironments/begimase' or the linked scope(s) are invalid."
}
}

New-AzAppServicePlan: Operation returned an invalid status code 'Forbidden'
DEBUG: AzureQoSEvent: Module: Az.Websites:2.8.3; CommandName: New-AzAppServicePlan; PSVersion: 7.1.4; IsSuccess: False; Duration: 00:00:02.4859727; Exception: Operation returned an invalid status code 'Forbidden';
DEBUG: Finish sending metric.
DEBUG: 16:12:32 - NewAzureAppServicePlanCmdlet end processing.

## Environment data

```
Name Value
---- -----
PSVersion 7.1.4
PSEdition Core
GitCommitId 7.1.4
OS Microsoft Windows 10.0.22000
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

## Module versions

```powershell
Directory: C:\Users\begim\Documents\PowerShell\Modules

ModuleType Version PreRelease Name PSEdition ExportedCommands
---------- ------- ---------- ---- --------- ----------------
Script 6.5.0 Az Core,Desk
```

## Debug output

```

```

## Error output

```

HistoryId: 16

Message : Operation returned an invalid status code 'Forbidden'
StackTrace : at Microsoft.Azure.Management.WebSites.AppServicePlansOperations.BeginCreateOrUpdateWithHttpMessagesAsync(String resourceGroupName, String name, AppServicePlan appServicePlan, Dictionary`2
customHeaders, CancellationToken cancellationToken)
at Microsoft.Azure.Management.WebSites.AppServicePlansOperations.CreateOrUpdateWithHttpMessagesAsync(String resourceGroupName, String name, AppServicePlan appServicePlan, Dictionary`2 customHeaders,
CancellationToken cancellationToken)
at Microsoft.Azure.Management.WebSites.AppServicePlansOperationsExtensions.CreateOrUpdateAsync(IAppServicePlansOperations operations, String resourceGroupName, String name, AppServicePlan
appServicePlan, CancellationToken cancellationToken)
at Microsoft.Azure.Management.WebSites.AppServicePlansOperationsExtensions.CreateOrUpdate(IAppServicePlansOperations operations, String resourceGroupName, String name, AppServicePlan appServicePlan)
at Microsoft.Azure.Commands.WebApps.Utilities.WebsitesClient.CreateOrUpdateAppServicePlan(String resourceGroupName, String appServicePlanName, AppServicePlan appServicePlan, String aseName, String
aseResourceGroupName)
at Microsoft.Azure.Commands.WebApps.Cmdlets.AppServicePlans.NewAzureAppServicePlanCmdlet.ExecuteCmdlet()
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.<>c__3`1.b__3_0(T c)
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet, Action`1 executor)
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet)
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception : Microsoft.Azure.Management.WebSites.Models.DefaultErrorResponseException
InvocationInfo : {New-AzAppServicePlan}
Line : New-AzAppServicePlan -ResourceGroupName "begim" -Name "begim-we-sub-ase-wap" -Tier "Isolated" -NumberofWorkers 1 -WorkerSize "Small" -AseName
"subscriptions//resourceGroups/ase-rg/providers/Microsoft.Web/hostingEnvironments/begimase" -AseResourceGroupName "ase-rg" -location uksouth -debug
Position : At line:1 char:1
+ New-AzAppServicePlan -ResourceGroupName "begim" -Name "begim-we-sub-a …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId : 16

The Azure PowerShell team is listening, please let us know how we are doing: https://aka.ms/azpssurvey?Q_CHL=ERROR.
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.