Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action error

[itConsultant45]

Describe the bug

I've created a Least Privilege environment, all was going well until I added the Action below.

Command (Windows bash, I also tried "pwsh -c '...'" as that sometimes helps...)

az role definition create --role-definition role.json

json file

{
  "Name": "...",
  "Description": "...",
  "AssignableScopes": ["/subscriptions/.../resourceGroups/..."],
  "Actions": [
    "Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action",
    ....
  ]
}

Error message

(InvalidActionOrNotAction) 'Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action' does not match any of the actions supported by the providers.
Code: InvalidActionOrNotAction
Message: 'Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action' does not match any of the actions supported by the providers.

Related command

az role definition create --role-definition role.json

{
"Name": "...",
"Description": "...",
"AssignableScopes": ["/subscriptions/.../resourceGroups/..."],
"Actions": [
"Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action",
....
]
}

Errors

(InvalidActionOrNotAction) 'Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action' does not match any of the actions supported by the providers.
Code: InvalidActionOrNotAction
Message: 'Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action' does not match any of the actions supported by the providers.

Issue script & Debug output

N\A

Expected behavior

Should give the definition Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action permissions.

Environment Summary

azure-cli 2.76.0

core 2.76.0
telemetry 1.1.0

Extensions:
containerapp 1.2.0b3
log-analytics 1.0.0b1

Dependencies:
msal 1.33.0b1
azure-mgmt-resource 23.3.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\x.azure'
Extensions directory 'C:\Users\x.azure\cliextensions'

Python (Windows) 3.12.10 (tags/v3.12.10:0cc8128, Apr 8 2025, 12:21:36) [MSC v.1943 64 bit (AMD64)]

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[jiasli]

The error is from Container App resource provider Microsoft.App.

From https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/compute#microsoftapp, I saw Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action is a DataAction.

Could you try putting it under DataActions field in your input JSON?

[uncledru]

I've put this under data actions and I'm still getting an error that permissions are not sufficient.

{
    "id": "/subscriptions/xxx/providers/Microsoft.Authorization/roleDefinitions/xxx",
    "properties": {
        "roleName": "pe-approval-role-def",
        "description": "Grants permissions to approve or reject private endpoint connections for specific Azure Storage and Container App resources.",
        "assignableScopes": [
            "/subscriptions/xxx"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Storage/storageAccounts/read",
                    "Microsoft.Storage/storageAccounts/privateEndpointConnections/write",
                    "Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action",
                    "microsoft.app/managedenvironments/read",
                    "microsoft.app/managedenvironments/privateendpointconnections/write"
                ],
                "notActions": [],
                "dataActions": [
                    "Microsoft.App/managedEnvironments/privateEndpointConnectionsApproval/action"
                ],
                "notDataActions": []
            }
        ]
    }
}

{"error":{"code":"LinkedAuthorizationFailed","message":"The client '<client_id>' with object id '<client_id>' has permission to perform action 'Microsoft.Network/privateEndpoints/write' on scope '/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Network/privateEndpoints/dev-we-jx8a-private-endpoint'; however, it does not have permission to perform action(s) 'Microsoft.App/managedEnvironments/PrivateEndpointConnectionsApproval/action' on the linked scope(s) '/subscriptions/xxx/resourceGroups/dev-we-x822/providers/Microsoft.App/managedEnvironments/dev-we-jx8a' (respectively) or the linked scope(s) are invalid."}}

The same exact setup, with Storage Accounts works perfectly fine. Why is this a dataAction instead of actions (as is with storageAccounts). Am I using an incorrect permission here?

[uncledru]

Looks like adding Microsoft.App/managedEnvironments/*/action under actions works fine. I wonder what permission is undocumented that allows this to work? Or is this a provider bug?

[Juliehzl]

@uncledru yes, we are fixing the issue in backend.