Unable to create service connection using a scope level of AzureMLWorkspace

[KBaroni]

In Azure DevOps, I cannot create a service connection using the scope level of 'AzureMLWorkspace'. The error generated suggests i don't have permission to add a role. As a workaround, i manually created an SP and had my subscription admin provide it 'contributor' role access. This approach also fails from the ADO side likely because the SP is not added as a user to the AML Workspace - and i don't have sufficient permissions as a 'contributor' to do so. This is a blocker for using Azure Model registration as an artifact for Azure DevOps and I have documented it on the ML Platform/AzureMLPython SDK teams channel.

[eedorenko]

@KBaroni what permission do you have in the subscription used to create a service connection? Can you provide the error message?

[KBaroni]

Hi Eugene: I have contributor level access in the azure subscription and am a project admin in the azure devops project. This is the error I get when I try to create a service connection with AzureMLWorkspace scope: A new Azure service principal will be created and assigned with the "Contributor" role, having access to all resources within the Workspace. Failed to set Azure permission 'RoleAssignmentId: 597b3445-352a-41fc-9eca-4f5edf6c93ce' for the service principal '911b87e4-61ef-4f01-b496-f946dd9bb0ed' on machine learning workspace ID '510ebabd-4d14-45f9-8b2f-757fda448fcc': error code: Forbidden, inner error code: AuthorizationFailed, inner error message The client 'kbaroni@microsoft.com' with object id 'd51035f6-4a0d-4ba6-8363-6943dacbcf5b' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/bf7adf12-c3a8-426c-9976-29f145eba70f/resourceGroups/kbtest/providers/Microsoft.MachineLearningServices/workspaces/kbtest/providers/Microsoft.Authorization/roleAssignments/597b3445-352a-41fc-9eca-4f5edf6c93ce' or the scope is invalid. If access was recently granted, please refresh your credentials. Ensure that the user has 'Owner' or 'User Access Administrator' permissions on the Workspace. For troubleshooting refer to link<https://go.microsoft.com/fwlink/?linkid=835898>. From: Eugene Fedorenko <notifications@github.com> Sent: Wednesday, August 28, 2019 11:10 AM To: microsoft/MLOpsPython <MLOpsPython@noreply.github.com> Cc: Kate Baroni <Kate.Baroni@microsoft.com>; Mention <mention@noreply.github.com> Subject: Re: [microsoft/MLOpsPython] Unable to create service connection using a scope level of AzureMLWorkspace (#56) @KBaroni<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.amrom.workers.dev%2FKBaroni&data=02%7C01%7CKate.Baroni%40microsoft.com%7Ca89be7039d464ceffd3e08d72bda81ca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637026089788232063&sdata=ZLg46zaY%2BiiehvJdpC%2FOS64hk6wJpE%2BVxO%2FscX0MMyc%3D&reserved=0> what permission do you have in the subscription used to create a service connection? Can you provide the error message? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.amrom.workers.dev%2Fmicrosoft%2FMLOpsPython%2Fissues%2F56%3Femail_source%3Dnotifications%26email_token%3DACZEWKRIKYCNO3JCFUHOI4TQG2WNDA5CNFSM4IRJ6J2KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD5L2AGQ%23issuecomment-525836314&data=02%7C01%7CKate.Baroni%40microsoft.com%7Ca89be7039d464ceffd3e08d72bda81ca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637026089788232063&sdata=Nk46mYCx8p1ng3CgP2lEffTTEqmcx9T%2BlBzNS3gE0s0%3D&reserved=0>, or mute the thread<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.amrom.workers.dev%2Fnotifications%2Funsubscribe-auth%2FACZEWKT2IP46TUDDHCQPHR3QG2WNDANCNFSM4IRJ6J2A&data=02%7C01%7CKate.Baroni%40microsoft.com%7Ca89be7039d464ceffd3e08d72bda81ca%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637026089788242059&sdata=HWQaOKcvkcWXGkcGdh93tN9wm5w3f7sZ8W0nTdRb6TQ%3D&reserved=0>.

[eedorenko]

So, yes, it expects to be an "Owner" or "User Access Administrator".

[KBaroni]

I just had my azure admin add the SP as an ‘owner’ to the AML Workspace, and it still doesn’t work. BTW, if owner level permissions is expected on the Azure subscription to execute this repo, that will be a significant blocker for any users with enterprise subscriptions. From: Eugene Fedorenko <notifications@github.com> Sent: Wednesday, August 28, 2019 12:04 PM To: microsoft/MLOpsPython <MLOpsPython@noreply.github.com> Cc: Kate Baroni <Kate.Baroni@microsoft.com>; Mention <mention@noreply.github.com> Subject: Re: [microsoft/MLOpsPython] Unable to create service connection using a scope level of AzureMLWorkspace (#56) So, yes, it expects to be an "Owner" or "User Access Administrator". — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.amrom.workers.dev%2Fmicrosoft%2FMLOpsPython%2Fissues%2F56%3Femail_source%3Dnotifications%26email_token%3DACZEWKX35QEAVHM2HVKVT3TQG24XNA5CNFSM4IRJ6J2KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD5L7EVY%23issuecomment-525857367&data=02%7C01%7CKate.Baroni%40microsoft.com%7C3959949826f048416ea108d72be20b84%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637026122236498117&sdata=0%2FjMqPe90HvFfEZMB%2FJsbdwgn7AjaJLpoKBnsPDBXv4%3D&reserved=0>, or mute the thread<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.amrom.workers.dev%2Fnotifications%2Funsubscribe-auth%2FACZEWKXGXFZODLUXQHNUN5DQG24XNANCNFSM4IRJ6J2A&data=02%7C01%7CKate.Baroni%40microsoft.com%7C3959949826f048416ea108d72be20b84%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637026122236508111&sdata=70N%2BFRehp3vYPTdush%2BDc3So6E%2B9ikvon0%2FZbJhOjv4%3D&reserved=0>.

[eedorenko]

It definitely works with the "owner" permission on the Azure subscription. But we'll check how it works with the "owner" permissions on AML Workspace only.

[KBaroni]

It does not work with 'owner' permissions on AML Workspace only. It works with owner permissions on RG - which can only be assigned by an azure subscription admin.

[eedorenko]

Thanks for confirming that. We'll add a note to the documentation that one should have owner permission on RG to create a service connection.

[sudivate]

@KBaroni Please ensure you have owner or user admin access on the workspace. Most probably your contributor access from the subscription is inherited to the workspace.
I have also updated doc with an explicit note on this.