This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
I got into a situation where I need to access AKS cluster ,so I have added below required permission by adding myself to the group and given necessary permission but getting below error
ERROR :The client 'abc' with object id 'XXXXXXXXXXXXXXXXXX' does not have authorization to perform action 'Microsoft.Resources/subscriptions/resourceGroups/read' over scope '/subscriptions/'XXXXXXXXXXXXXXXXXX'/resourceGroups/XXXX-014-aks-rg' or the scope is inis invalid. If access was recently granted, please refresh your credential
Please check below Images
Error Image
Permission Image
Action Already tried:
Please help
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 13%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBB%3C/text%3E%3C/svg%3E)
Hello Deepanshu katara,
Trust you are doing great.
I noticed from the error you posted that you do not have the permission needed.
You have been assigned a role on the AKS but not on the resource group where the AKS is.
You need a read permission on the Resource group (corp-dev-014) where the AKS is.
Let me know if this helps.
Babafemi
Hi Babafemi,
Thanks for your response but if you see the 2nd image I have pasted in my question you can see that I also have reader permission at RG level, for your ref
Hello Deepanshu katara
This screenshot shows IAM on the Kubernetes Service and not the RG.
I should see something like what it is in the screenshot below
Ok ,please check below then
If this is the case, then just wait a while or use Incognito....as you have the necessary permission to perform this
Even incognito didn’t helped, no issues take your time
Any update on this if possible , Thank!
Looking at the error again, I am still of the opinion that the necessary permission hasn't been assigned. Check the error screenshot and the last screenshot you posted, the resource group names are different. In the error screenshot, the resource group referenced is corp-dev-014-aks-rg. On the screenshot where I asked for to see your permission on the resource group, the resource group name ended with cc-rg.
I think babafemi you are missing something here if you clearly see the error screenshot what you are saying is not a RG but a subscription , please check once I have highlighted it there is no RG with name corp-dev-014-aks-rg. , we have subscription with name corp-dev-014 and RG with name corp-dev-014-ikcy-cc-rg.
Thanks
Hello Deepanshu katara,
If this is the case, then there is something wrong with the scope and not the permission based on this screenshot.
Now we need to check the reason for this denial thoroughly.
Can you check if you have a dual account?
Babafemi
I only have single account
Hello Deepanshu katara,
We noticed your feedback that the above answer was not helpful.
Thank you for taking time to share feedback.
You have tried all the suggestions shared by Babafemi, and are still running into issues. I would recommend you to open a azure support case. Support team will be able to check and help on this.
Ok sure , Thanks!