I keep trying to update the service principal in my Azure Pipeline. I am not the owner of the project, but a contributor. I keep getting this error:
Error: Failed to fetch App Service publishing credentials. The client does not have authorization to perform action over scope or the scope is invalid. If access was recently granted, please refresh your credentials. (CODE: 403).
I tried to have the owner of the project update the pipeline, and that didn’t work either and I got the same error.
I also tried to follow the instructions here: Why does Azure Pipelines say “The environment does not exist or has not been authorized for use”? and none of answers worked either.
Environments:
Staging:
Production:
Security:
task: DotNetCoreCLI@2
displayName: 'Restore NuGet Packages'
inputs:
command: 'restore'
projects: '**/*.csproj'
feedsToUse: 'select'
verbosityRestore: 'Normal'
- task: DotNetCoreCLI@2
displayName: 'Build Projects'
inputs:
command: 'build'
projects: '**/*.csproj'
arguments: '--no-restore --configuration $(buildConfiguration)'
verbosityRestore: 'Normal'
- task: DotNetCoreCLI@2
displayName: 'Run Tests'
inputs:
command: 'test'
projects: '**/*.Tests.csproj'
arguments: '--no-restore --no-build --configuration $(buildConfiguration)'
testRunTitle: 'Run Tests'
- task: DotNetCoreCLI@2
displayName: 'Publish Projects'
inputs:
command: 'publish'
publishWebProjects: false
projects: '$(projectsToPublish)'
arguments: '--no-restore --no-build --configuration $(buildConfiguration) --output $(Build.ArtifactStagingDirectory)'
- publish: $(Build.ArtifactStagingDirectory)
displayName: 'Publish Artifacts'
artifact: '$(artifactName)'
3
The error you are getting points to the permissions of the Service principal you are using within the Azure App service deployment task.
To start with, check the permission the Service Principal has on the App Service. Atleast a Contributor role should be assigned to the SP on the resource to be able to perform the operation
If the necessary permission is assigned, you might want to double check the scope used in your pipeline. Makse sure the correct scope is used in your pipeline task. It should be something like this
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Web/sites/{appName}
I hope this helps.