Unable to see subscription list

[amigood]

After deploying the app and configuring the admin, I am unable to see the subscription list when navigating to the subscription page. It is empty.

What would cause the 403 errors?

[DCMattyG]

Hi there @amigood, these 403's you're seeing are generally because permissions were not applied properly during the deployment of the Azure IPAM solution.

During the deployment, did you see any warning or error messages?

In the logs folder (within the IPAM directory) do you see any errors in the deployment log file?

[amigood]

I'm seeing:

PowerShell\Modules\Az.Resources\6.16.1\MSGraph.Autorest\custom\Update-AzADApplication.ps1:545:5
Line |
545 | Az.MSGraph.internal\Update-AzADApplication @PSBoundParameters
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Insufficient privileges to complete the operation.

I split up the deploy and did -AppsOnly with a GA account (worked)

And the infrastructure install with the account that has owner role for the subscription and User Access Admin at the root tenant. The error came from the infrastructure install using these parameters:

./deploy.ps1 -Location "westus3"
-ParameterFile ./main.parameters.json `
-Tags @{owner = '[email protected]'; environment = 'development'}

[DCMattyG]

That's interesting because that step shouldn't be executed when doing the Infra Only install.

I noticed you are missing a tick after the first line, was that a typo? If the tick was missing on the first line PowerShell won't know there are other lines and may have tried to do a Full deployment. You can confirm this by looking at the deployment log file and it says at the very top what type of deployment it attempted to do.

Also when was the last time you did a git pull to grab the latest code? I see the error you pasted shows Update-AzADApplication on line 545, but that doesn't align with the current deploy.ps1 script in the main branch.

[amigood]

It appears it was a typo. Here is what I ran:

In the deployment log, it shows AppContainer:

NOTE: IPAM Deployment Type: AppContainer
INFO: Fetching Tenant ID from Azure PowerShell SDK
INFO: Fetching Azure Cloud type from Azure PowerShell SDK
INFO: Validating Azure Region selected for deployment
INFO: Azure Region validated successfully
INFO: Importing values from Bicep parameters file
INFO: Successfully import Bicep parameter values for deployment
INFO: Deploying IPAM bicep templates
INFO: IPAM bicep templates deployed successfully
INFO: Updating UI Application with SPA configuration
Update-AzADApplication_UpdateExpanded: C:\Users\name\Documents\PowerShell\Modules\Az.Resources\6.16.1\MSGraph.Autorest\custom\Update-AzADApplication.ps1:545:5
Line |
 545 |      Az.MSGraph.internal\Update-AzADApplication @PSBoundParameters
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Insufficient privileges to complete the operation.
Update-AzADApplication_UpdateExpanded: C:\Users\name\Documents\PowerShell\Modules\Az.Resources\6.16.1\MSGraph.Autorest\custom\Update-AzADApplication.ps1:545:5
Line |
 545 |      Az.MSGraph.internal\Update-AzADApplication @PSBoundParameters
     |      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Insufficient privileges to complete the operation.

INFO: UI Application SPA configuration update complete
INFO: Azure IPAM Solution deployed successfully

POST DEPLOYMENT TASKS:
##############################################
Navigate In Browser To:
https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Authentication/appId/ebae0d0d-2776-4c1e-9d0f-3b3edf372442
Change 'Redirect URI' To:
https://ipam-e34czpdsiofdy.azurewebsites.net
##############################################

**********************
PowerShell transcript end
End time: 20240409124255
**********************

I cloned the git repo today for the deployment. Should I have done a pull after the clone?

[DCMattyG]

Thanks for the excellent details @amigood. Please allow me to test this on my end to verify I don't have any bugs in the deployment script and I'll circle back with you shortly.

[DCMattyG]

Can you show me the response body from one of the 403's you're seeing in the Developer console?

[amigood]

[DCMattyG]

Would you mind dropping me an email at [email protected] so we can schedule a brief Teams meeting to look over this? I'd like to dive a bit deeper with you to see what's going on here because at first glance I'm not sure why you'd be seeing this and it will be much quicker to run through a few tests together.

[DCMattyG]

Just to close this out for anyone viewing this in the future, I met with @amigood and it ended up being related to this item from the Troubleshooting guide:

https://azure.github.io/ipam/#/troubleshooting/README?id=new-azroleassignment-failed

Hope that helps!