Access Denied using Azure App Configuration Task in DevOps Pipeline

Question

I am trying to use the DevOps Azure App Configuration task and I keep getting the error message "Access Denied".

I have triple checked and the Service Principal has both;

• Admin level "Owner" permissions to the App Config resource
• Full Get/List permissions to KeyVault used by the App Config instance

There seems to be very little I can "get wrong" with this particular extension - the options are limited to:

1. Select Service Connection
2. Select App Config instance

.. and thats about it

Does anyone have any suggestions?

Answer 1

The role 'Owner' does not grant access to the configuration values.

Contributor or Owner: Use this role to manage the App Configuration resource. It grants access to the resource's access keys. While the App Configuration data can be accessed using access keys, this role doesn't grant direct access to the data using Microsoft Entra ID. This role is required if you access the App Configuration data via ARM template, Bicep, or Terraform during deployment.

Source: Authorize access to Azure App Configuration using Microsoft Entra ID - Azure built-in roles for Azure App Configuration.

The role you'll need is App Configuration Data Reader if you need to read values, or App Configuration Data Owner if you need read/write/delete access to App Configuration data.