Error while creating new role assignment in Azure

Question

For a given Azure subscription I want to assign custom role to Service Principal. In order to achieve this, I first check if the custom role definition exists in the subscription. If the role does not exists I update the role definition's assignable scope to include this subscription. I am facing 'RoleDefinitionDoesNotExist' error intermittently when I try to assign role. How do I fix this?

My code:

$roleDef = Get-AzureRmRoleDefinition -Name $azureRmRole
if($roleDef -eq $null)
{
    Select-AzureRmSubscription -SubscriptionName $prodSubscription
    #Role definition exists in $prodSubscription
    $newRole = Get-AzureRmRoleDefinition -Name $azureRmRole
    #$scope = '/subscriptions/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx'
    $newRole.AssignableScopes.Add($scope)
    $def = Set-AzureRmRoleDefinition -Role $newRole
    # I have verified that role definition is updated
}

Select-AzureRmSubscription -SubscriptionName $SubscriptionName
New-AzureRmRoleAssignment -RoleDefinitionName $azureRmRole -ObjectId $SPNid -Scope $scope

Error:

New-AzureRmRoleAssignment : The specified role definition with ID 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx' does not exist. At C:\Untitled1.ps1:71 char:1 + New-AzureRmRoleAssignment -RoleDefinitionName $azureRmRole -ObjectId ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : CloseError: (:) [New-AzureRmRoleAssignment], CloudException + FullyQualifiedErrorId : Microsoft.Azure.Commands.Resources.NewAzureRoleAssignmentCommand

Hi, could you find your custom role on Azure Portal? You could use New-AzureRmRoleDefinition to create a custom role. — Shui shengbao
@Walter-MSFT Yes, I am able to find custom role on Azure Portal. — Ramana
$azureRmRole the vaule is your custom Name. In my example, the name is Virtual Machine Power Manager, do you sure it exist? — Shui shengbao
What is weird is, even though I get this exception. I am able to see role assignment done on Azure Portal. — Ramana
For test, could you assign role for your service principal on Portal? I test in my lab, I could. — Shui shengbao

Shui shengbao Shui shengbao · Accepted Answer · 2017-09-18T02:12:23

You should define your custom role like below:

{
  "Name": "Virtual Machine Power Manager",
  "IsCustom": true,
  "Description": "Can monitor, stop, start and restart v2 ARM virtual machines.",
  "Actions": [
    "Microsoft.Storage/*/read",
    "Microsoft.Network/*/read",
    "Microsoft.Compute/*/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/powerOff/action",    
    "Microsoft.Compute/virtualMachines/deallocate/action",
    "Microsoft.Compute/virtualMachines/restart/action",
    "Microsoft.Authorization/*/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Insights/alertRules/*",
    "Microsoft.Insights/diagnosticSettings/*",
    "Microsoft.Support/*"
  ],
  "NotActions": [

  ],
  "AssignableScopes": [
    "/subscriptions/c25b1c8e-xxxx-1111-abcd-1a12d7012123"
  ]
}

According to your description, you role's definition maybe wrong, you had better check it.

If you want to give custom role to a service principal, please try to use the following cmdlet.

New-AzureRmRoleAssignment -ServicePrincipalName "https://shuiweb.azurewebsites.net" `
                          -RoleDefinitionName 'Virtual Machine Power Manager' `
                          -Scope '/subscriptions/*******'

The blog:AZURE AUTOMATION RUNBOOKS WITH AZURE AD SERVICE PRINCIPALS AND CUSTOM RBAC ROLES will be helpful.

Error while creating new role assignment in Azure

1 Answers