Problem Space
When deploying Azure solutions with Infrastructure as Code, we often create role assignments as part of the deployment. For example, a Bicep deployment may give a Function App’s managed identity access to a Key Vault, storage account, or Service Bus namespace.
It is easy to focus on the role being assigned and forget about the identity performing the deployment. The deployment service principal needs permission to create the role assignment itself. Access to the target resource does not automatically provide this permission.
When that permission is missing, the deployment commonly fails with an error similar to:
The client '<deployment-client-id>' with object id '<object-id>' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '<scope>'.
And then comes the familiar question: what was that role I needed to assign to the deployment identity?
Explanation
The role is Role Based Access Control Administrator.
This is an Azure built-in role that allows an identity to manage role assignments at the scope where the role is assigned. In practical terms, it gives the deployment service principal permission to create and remove the RBAC assignments declared by the IaC templates.
This role is separate from the role being granted by the deployment:
- The deployment service principal needs permission to write the role assignment.
- The managed identity or application receives the role assignment.
- The target resource is where that access is granted.
The Role Based Access Control Administrator role has the built-in role ID f58310d9-a9f6-439a-9e8d-f62e7b41a168. It should not be confused with User Access Administrator, which is another role that can manage access and has a different permission boundary.
Solution
Assign the Role Based Access Control Administrator role to the deployment service principal at the narrowest scope that contains the role assignments. For example, at resource-group scope.
Once this has been assigned, the deployment identity can create the resource role assignments in that resource group, subject to the normal restrictions on which roles it is allowed to assign.
The identity used to assign this permission must already be authorized to create role assignments. This is usually a one-time platform or subscription setup task, rather than something the deployment should attempt to grant to itself.
⚠️ Best Practice of Least Privilege: avoid assigning this role at subscription scope when the deployment only needs to manage assignments within one resource group or resource.
So, when an Azure IaC deployment fails while creating a role assignment, check the deployment service principal first. This is to jog my memory as well as yours, the role you are looking for is Role Based Access Control Administrator.
Hope this helps, and have fun.
