Azure Error: The client does not have authorization to perform action (AuthorizationFailed)
Quick answer
AuthorizationFailed means your signed-in identity lacks a role with the needed permission at that scope. Assign the right role and wait up to 10 minutes or sign in again.
Most likely fix: Grant the right role
How to fix it
Try these in order — the most common fix is first.
1. Grant the right role
- Open Access control (IAM) on the resource, resource group or subscription
- Use Check access to see your effective roles
- Assign a role with the needed action, for example Virtual Machine Contributor
Did this fix it?2. Refresh your permissions
- Wait up to 10 minutes after assigning
- Sign out and sign in again, or refresh the access token for REST calls
Did this fix it?3. Role assignment errors
- Adding a role needs Microsoft.Authorization/roleAssignments/write, for example Role Based Access Control Administrator
- With a service principal in CLI use --assignee-object-id to avoid the Insufficient privileges error
Did this fix it?
Symptoms
Creating or changing a resource fails with 'The client with object id does not have authorization to perform action over scope (code: AuthorizationFailed)', or the portal says 'You don't have permission'.
Why it happens
- Role does not include the write action at that scope
- Recent role assignment cached; can take up to 10 minutes
- ABAC condition restricts what you can assign
- Managed identity group changes can take hours
- Guest user has no role at the scope
This guide also covers
- azure authorizationfailed
- azure the client does not have authorization to perform action
- azure rbac permission denied
- azure role assignment not working
Still not working?
If Azure keeps failing, you're not alone. See every Azure problem users report or the alternatives people switch to.
Have an app idea? Our small team builds any software: web and mobile apps, games, desktop, AI tools. Price agreed together.
Talk to usThe same problem in other apps
All not loading, error messages & connection guides →
EC2 SSH Connection Timed Out (AWS)
Google Cloud Quota Exceeded Error (Google Cloud)
DigitalOcean Droplet SSH Connection Refused or Timed Out (DigitalOcean)
Can't SSH Into Linode: Connection Refused or Timed Out (Linode)
Other Azure errors
- Azure Subscription Disabled: Spending Limit Reached
- Azure Free Account Ended: Credit Expired, Subscription Disabled
- Azure Error: Operation results in exceeding quota limits of Core
- Azure App Service HTTP 503 Service Unavailable / 502 Bad Gateway
- Azure App Service Container Didn't Respond to HTTP Pings / Fails to Start
- Azure Unexpected Charges: How to Find What Is Costing You Money
- How to Cancel and Delete an Azure Subscription
- Azure Subscription Disabled: Payment Wasn't Received