My goal is to create/update/delete security rules and NSG in my Azure portal through a python script calling the Azure Service Management APIs

I am trying to create security rules in an NSG group using the APIs https://docs.microsoft.com/en-us/rest/api/virtualnetwork/securityrules/createorupdate

I have done the authorization part using the OAuth APIs and using the received Authorization Token to authenticate API requests send to create security rules.

The error I am getting is below:- {'error': {'code': 'AuthorizationFailed', 'message': "The client <myobject_id> with object id '<my-object_id>' does not have authorization to perform action 'Microsoft.Network/networkSecurityGroups/securityRules/action' over scope '/subscriptions/<my_subscriptions_id>/resourceGroups/<my_resource_group_name>/providers/Microsoft.Network/networkSecurityGroups/<my-nsg-name>/securityRules/<my-securityRules-name>' or the scope is invalid. If access was recently granted, please refresh your credentials."}}

I have added the API Permission for Azure Service Management to my APP, what else I can do here.

Will appreciate your quick help! Regards Arpita


First up, you want to change your terminology, Azure Service Management (ASM) is the old provider for working with Azure Classic resources, you do not want to be using this, and the link you posted is not doing that. Instead you need to work with Azure Resource Manager (ARM), which is what that link is for.

Secondly, you need to grant your service principal Azure RBAC permissions on the subscription or resource group where you want to create the resources. These are not App permissions that you see in the application settings, these are permissions on the IAM tab in the Azure portal for where you want to deploy resources. Grant your service principal the appropriate role and you will then be able to create the resources.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.