Unable to see Azure Policy non-compliance reason through Lighthouse

Wojciech Różański 21 Reputation points
2022-12-07T15:35:42.093+00:00

Hello,

I am trying to check the reason for non-compliance for an Azure policy. When I do this using a Lighthouse-delegated account, it's not possible. The following error comes up:

Encountered an error while authorizing the client [me] with object id [my_object_id] on action 'microsoft.storage/storageaccounts/read' over scope '/subscriptions/[subscription_id]/resourceGroups/cloud-shell-storage-westeurope/providers/microsoft.storage/storageaccounts/[storage_account]'. If the issue persists, make sure that the subscription: [subscription_id] is registered to 'Microsoft.PolicyInsights'. See https://aka.ms/ResourceProviderSubscriptionRegistration for more details.

The subscription is registered to Microsoft.PolicyInsights.
My account has the Reader role assigned on the subscription level.

Is this a known limitation or a bug?

Kind regards,
Wojciech

Azure Lighthouse
Azure Lighthouse
An Azure service that provides secure managed services and access control for partners and customers.
71 questions
Azure Policy
Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
821 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. AnuragSingh-MSFT 21,236 Reputation points
    2023-01-24T05:58:08.3066667+00:00

    [@Wojciech Różański ] I just heard back from the team that "cross-tenant calls are not supported for the feature as of now". Therefore, it is not possible for a user delegated through Azure Lighthouse to be able to view the compliance reason.

    The "feature" in my reply above means the "ability to check the non-compliance reason OR policy evaluation details". The user delegated to "reader" role through Lighthouse can view the compliance state of resource (compliant or non-compliant) in the Policy's compliance view. However, further calls from this user (from a different tenant) to get the details of non-compliant reason (policy evaluation details) are not supported, causing the error message as seen in this case.

    I would request submitting it as an idea on the feedback portal for Azure Governance for it to be considered in future.

    0 comments