Registered application not able to update VM sizes.

Question

Hi There,

I built a small script capable of updating VM os disk size by getting the Vm and then updating the Hardware profile accordingly. The registered application has "Virtual Machine Contributor" role assigned for the scope of the VM used here.

Connect-AzureRmAccount -TenantId $tenantId -CertificateThumbprint $certificateThumbprint -ApplicationId $applicationId -ServicePrincipal   
Get-AzureRmSubscription | Where-Object {$_.Id -eq $subscriptionId} | Set-AzureRmContext   
$vm = Get-AzureRmVm -ResourceGroupName $resourceGroupName -Name $vmName   
$vm   
$vm.HardwareProfile.VmSize   
$vm.HardwareProfile.VmSize = $diskName   
Update-AzureRmVm -VM $vm -ResourceGroupName $resourceGroupName

On revisiting the script I'm seeing that it fails to propagate the changes with the following reason:

... however, it does not have permission to perform action    
'Microsoft.Network/networkInterfaces/join/action' on the linked scope(s)...

This error keeps coming with different connected components. It seems to be needing permissions to all the linked components, like NIC, OS disk and Data disks. Has there been any recent update which I'm missing? or was it bad from the start?

Answer 1

Hi @Aditya Nath ,

First of all, even if it's maybe not the reason I would recommend not to use the AzureRM module. Instead use the AZ module.

Maybe it's possible to change the role assignment to "Contributor" just for testing if this solves the issue.

Another option for testing is:
Create a new user with "Virtual Machine Contributor" role assigned and give it a try with the script.

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Answer 2

The 'Virtual Machine Contributor Role' should have access to join a Network Interface. You can find an exact definition of this role Here.

I would start by verify that the registered application has the role over the Subscription or Resource Group that you are receiving these errors on.