Search code examples
azure-active-directorypostmanazure-rest-apiazure-subscription

Not able to connect to azure from postman application - 403 forbidden error

I'm trying to GET https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups?api-version=2020-09-01 using postman application from my desktop. For Authorization I passed the bearer token acquired from the response.

However getting the below error.

{ "error": { "code": "AuthorizationFailed", "message": "The client '02d899d6-c2d5-47d3-' with object id '02d899d6-c2d5-47d3-87b' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourcegroups/read' over scope '/subscriptions/{{subscriptionId}}' or the scope is invalid. If access was recently granted, please refresh your credentials." } }

I'm not able to find this client id in my subscription to assign the role. Where can I find this client id in the portal? Also tried to register the postman app in my subscription but the create operation is greyed out. Could anyone help on this?

Solution

  • I tried to reproduce the same in my environment and got below results

    I registered one Azure AD application and granted API permission like below:

    enter image description here

    I generated access token via Postman using below parameters:

    POST https://login.microsoftonline.com/<tenantID>/oauth2/v2.0/token

grant_type:client_credentials
client_id:<appID>
client_secret:<secret>
scope: https://management.azure.com/.default

    Response:

    enter image description here

    When I used that token to list resource groups, I got same error as you like below:

    GET https://management.azure.com/subscriptions/<subID>/resourcegroups?api-version=2020-09-01

    Response:

    enter image description here

    The client ID in the error is the ObjectID of service principal associated with your Azure AD application having same name that can be found here:

    Go to Azure Portal -> Azure Active Directory -> Enterprise Applications -> All applications -> Select Application

    enter image description here

    To resolve the error, assign Reader role to your service principal under your subscription as below:

    Go to Azure Portal -> Subscriptions -> Your Subscription -> Access control (IAM) -> Add role assignment

    enter image description here

    Note that, you need to have either Owner or User Access Administrator role on your subscription to assign RBAC roles.

    After assigning the role, I generated the token again and got the list of resource groups successfully like below:

    GET https://management.azure.com/subscriptions/<subID>/resourcegroups?api-version=2020-09-01

    Response

    enter image description here