Why do I get the error 'The provided information does not map to an AD object id.' when executing New-AzRoleAssignment using a Service Principal?

0
votes

Using Powershell in an Azure DevOps pipeline, I am trying to assign the key vault's principal the role Storage Account Key Operator Service Role to a storage account.

Command Line

The command line is run after I connected Azure with the service principal:

$credentials = New-Object -TypeName System.Management.Automation.PSCredential($servicePrincipalApplicationId, $clientSecret)

Connect-AzAccount -ServicePrincipal -Credential $credentials -Tenant $tenantId

Here is the command line that I execute :

New-AzRoleAssignment -ApplicationId $keyVaultServicePrincipalId -ResourceGroupName $resourceGroupName -ResourceName $storageAccountName -ResourceType "Microsoft.Storage/storageAccounts" -RoleDefinitionName "Storage Account Key Operator Service Role"

Where:

  • $keyVaultServicePrincipalId is the pre-registered principal ID for Key Vault. Its value is cfa8b339-82a2-471a-a3c9-0fc0be7a4093.
  • $resourceGroupName is the name of the resource group in which the storage is located. Its value is accountsmanager-test-global-rg.
  • $storageAccountName is the name of my storage account. Its value is accountsmanagertest.

Service Principal

Here are the permission of the service principal under which the command is run:

Service Principal permissions

The command is run as a Service Principal that has the Owner role in the subscription:

Owner in Subscription

The resource group created in that subscription is also owned by that Service Principal:

Owner in Resource Group

Question

When I run the command, I get the following error:

New-AzRoleAssignment: The provided information does not map to an AD object id.

Why do I get the error The provided information does not map to an AD object id. when executing the command New-AzRoleAssignment?

1
azurepowershellazure-devopsazure-keyvaultazure-rbac

1 Answers

1
votes

I can also reproduce this on my side, there are two issues.

enter image description here

1.In your command, the ResourceType should be Microsoft.Storage/storageAccounts, not Microsoft.Storage/storageAccount.

2.In the API permission of your AD App related to the service principal used in the DevOps servcie connection, you need to add the Application permission Directory.Read.All in Azure Active Directory Graph, not Microsoft Graph.

enter image description here

enter image description here

enter image description here

After a while to take effect, it will work fine.

enter image description here