Request failed with status code 403 on Admin Screen

[jquinn99002]

Hi,

Trying out Azure IPAM for the first time, managed to get it deployed rather easily, but I have found that when I go to the Admin Screen, I get 'Request failed with status code 403' when clicking on the User Search Box, ie:

I also note that myself is not even showing as an Admin (despite having admin access).

Can someone help with debugging this and resolving?
Im assuming its to do with one of the App Registrations not having the right access, but they all look to be granted:

[DCMattyG]

Hi @jquinn99002, appreciate you reaching out for support on this, and of course I'm happy to assist!

From your screenshots, it does indeed appear that you have the correct permissions applied to the App Registrations and those permissions have been granted Admin Consent.

Quick question for you, has this deployment been working for you up until this point and now things have stopped working as expected, or is this a new deployment and you're having some trouble getting everything working initially?

[DCMattyG]

Good question @jquinn99002 on cost, and you're right that it does "depend". I would say the non-discounted PAY-AS-YOU-GO rate for the default services would be less than $150/mo. You can obviously fine-tune this more, and of course any negotiated discounting you have with an EA/MCA apply as well.

Making this private is also a snap, it essentially involves creating private endpoints on each of the components and making sure the Private DNS Zones are linked correctly to whatever enterprise DNS solution you're leveraging for your hybrid DNS strategy with Azure. I can provide more specifics on this if required.

Let me know how the re-deploy goes, I'm here if you need anything at all!

[jquinn99002]

Hey,

So redeploy resulted in the same issue, but after a bit of "testing" this morning with a colleague, we discovered something, i'll try and explain the scenario as I think we have a enhancement request somewhere in here...

I have two users, lets call them:

• [email protected] (Local Entra User)
  • This user has all the required privileges for the Azure IPAM Solution
• user_tenant2.com#EXT#@tenant1.onmicrosoft.com (Guest Entra User)
  • This user does NOT have all the required privileges for the Azure IPAM Solution

I deploy the full solution using [email protected]
But when I browse to the site, it never asks me which logged in Entra user to use... ie: the "Pick an account" screen:

How does it know which user to go through as, as it seems to be picking the wrong one in my case.

If I log into a single account in incognito, I get the expected results:

• [email protected] can add Admins
• user_tenant2.com#EXT#@tenant1.onmicrosoft.com cannot add Admins

So the issue is around the app using the wrong logged in user as it never asks which one to use.

[DCMattyG]

Hi @jquinn99002, you should indeed be prompted to select an account under these conditions:

1. You do not have an existing session.
2. You have multiple sessions and you're required to pick one to proceed to the application.

Are you saying that even in a brand new InPrivate browsing session that when you navigate to the Azure IPAM UI that you are not prompted to select a Microsoft Account in order to proceed?

Another way is that you can select the "Logout" option from within the Azure IPAM UI, which should force you back to the Microsoft login screen:

[jquinn99002]

A bit of further debugging....
Using Incognito with both users logged in, I get the switcher as expected.
Not using Incognito, I don't get the switcher (unless if I "Logout")

The difference between running in incognito and not, is that when not in incognito, one of these logged in sessions is "Connected to windows"

It seems like when there is a "Connected to windows" login, its assuming to use that one when first browsing to the site.

Let me know if you want to run through a bit of debug on a screen share or anything.

[DCMattyG]

Of course I would be more than happy to help you @jquinn99002 👍

Can you drop me an email at [email protected] so we can arrange a day/time and setup a Teams meeting to explore this further?

Thanks much, and looking forward to getting you up & running!