Getting permissions error when trying to deploy to a azure resource in a pipeline in azure devops

Question

I hope someone can help me.

I am creating a pipeline in Azure Devops taking an existing reference yaml where I basically have a step where I need to deploy to an Azure resource function, within an Azure subscription, from which I have permissions to read, create and delete resources.

The deploy step is:

Settings
- task: AzureFunctionApp@1
  inputs:
    azureSubscription: 'private-suscription-dont-show-name'
    appType: 'functionApp'
    appName: 'chatbot-service-functions2'
    package: '$(System.DefaultWorkingDirectory)/**/*.zip'
    deploymentMethod: 'auto'

Basically I click on the setting option and it opens a menu for me.

I choose in the option "Azure subscription" the subscription where I have the resource that I want to deploy, the name of the subscription appears and I choose it without any problem.
At the same time that I choose the name of the subscription I get an option "Authorize" in which I click, and immediately I get an error:

Service connection with name 'private-suscription-dont-show-name' already exists. Only a user having Administrator/User role permissions on service connection 'private-suscription-dont-show-name' can see it.

My question is why can't I deploy, using autocomplete, to a resource within a subscription in which I have permission to read, create and delete resources? Do I have any other option to deploy without autocomplete?

Hi @Cesar Castillo, How are things going? Is the explanation in my answer helpful to you? Please try as my suggestion that check your access role on the service connection. Any progress, feel free to tell me. — Bright Ran-MSFT
Yes, I think your answer is correct, it is more of a Governance problem in the company where I live. I ended up depending on someone with permissions to solve this problem — Cesar Castillo

Bright Ran-MSFT Bright Ran-MSFT · Accepted Answer · 2020-12-09T08:18:27

This is related to the Security for service connections on DevOps.

The users who have Administrator or User role on a service connection can use this service connection. The Reader role can see the service connection but not use it.

If you (or the group/team you are in) are not added as a member on the User permissions of a service connection, generally you have no access to see and use this service connection in the project.

To gain the permissions on a service connection, you need to contact the Project Administrators or the Administrators on this service connection to grant you the Administrator or User role on this service connection.

Getting permissions error when trying to deploy to a azure resource in a pipeline in azure devops

1 Answers