Azure / Azure/azure-powershell

New-AzSqlDatabaseRestorePoint Missing Permission

Open
#22,715 3 comments 0 reactions 0 assignees View on GitHub
act-observability-squad bug customer-reported Service Attention SQL - Backup & Restore
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

We have a custom role with defined RBAC only for Resotre SQL Server Operation. After we gave all the relevant permission, we still got a specific permission error is missing called `Microsoft.Sql/servers/databases/restorePointsOperationResults/read` . When I checked the portal, there was no such permission available. There are no docs also there about this role.

### Issue script & Debug output

```PowerShell
{

  "error": {

    "code": "AuthorizationFailed",

    "message": "The client 'xxxxxx' with object id 'xxxx' does not have authorization to perform action 'Microsoft.Sql/servers/databases/restorePointsOperationResults/read' over scope '/subscriptions/xxxx/resourceGroups/gssqa-db-rg-01/providers/Microsoft.Sql/servers/sql/databases/synapsedbrefresh202307250405/restorePointsOperationResults/133379600050000000' or the scope is invalid. If access was recently granted, please refresh your credentials."

  }

}
```
```

### Environment data

```PowerShell
PSVersion 7.2.4
PSEdition Core
GitCommitId 7.2.4
OS Darwin 22.6.0 Darwin Kernel Version 22.6.0: Wed Jul 5 22:21:56 PDT 2023; root:…
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
Az.Accounts Module Version 2.12.5
Az.Sql Module version 4.9.0
```

### Error output

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the New-AzSqlDatabaseRestorePoint entry point and the reported Microsoft.Sql/servers/databases/restorePointsOperationResults/read action, using the supplied Az.Sql 4.9.0 and PowerShell 7.2.4 environment. Compare the restore-point operation with the custom RBAC permissions; done means the missing permission is accounted for and the reported AuthorizationFailed error is resolved or clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell, sql
Domain
authorization, cloud, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.