Azure Write Permissions: Troubleshooting Errors
Most write permission problems come from the credential, the role's actions, the scope it is assigned at, or Azure still propagating a change. Azure can take 5–10 minutes to apply a role assignment, so wait and retry before changing anything else.
Common Problems
| What you see | Likely cause | Fix |
|---|---|---|
| Validate Connection fails | Wrong Application ID or Tenant ID, the secret ID was pasted instead of the secret value, part of the value is missing, or the secret has expired | Re-enter the IDs and the full secret value. If the secret expired, create a new one (see below). |
| Validation fails right after assigning roles | Role propagation delay | Wait 5–10 minutes and validate again. |
| Validation fails and the app can't be found | The app registration was disabled or deleted | Check Entra ID > App registrations for your Spotto write app. |
| Spotto reports a permission error when it acts | The custom role is missing an action for a feature you enabled | Compare the role with the JSON in Custom Role for Least Privilege. See Custom Roles and Advisor required permissions. |
| Permission error on some subscriptions only | The role is assigned on the wrong subscription, at a resource group, or not on every subscription | Check Access Control (IAM) on each subscription and assign the role at subscription scope. |
| Permission error even though the role looks right | An Azure Policy or deny assignment blocks the action | Review policies at subscription and management group level, especially deny policies. |
| Validation or actions fail with an expired credential | The client secret expired, or was rotated in Azure without updating Spotto | Create a new client secret, update it in Spotto, select Validate Connection, then delete the old secret. |
| Nothing happens in Azure after an action in Spotto | The feature isn't ticked, Enable write access is off, or the change wasn't saved | Tick the feature under Write Permissions, check the credentials, and select Update. |
| You can't assign roles in Azure | You don't have Owner or User Access Administrator, or a policy restricts role assignments | Check your own access in Access Control (IAM) or ask your Azure administrator. |
| Storage inventory Test Connection fails | Storage inventory analysis is reader-only and has its own prerequisites | See Azure Storage Inventory troubleshooting. |
To test a fix, dismiss a single recommendation in Spotto and check that it is dismissed in Azure Advisor. The Azure Activity Log, filtered by your Spotto write app as Caller, shows the error Azure returned.
For policy exemption errors such as invalid_client or an inherited assignment failing, see Policy Exemptions.
Need More Help?
Contact Us with:
- Error messages from the Spotto Portal
- Azure Activity Log entries showing the issue
- Screenshots of the role assignments
- The subscription ID and the write app's Application ID
Related: Configuration, Custom Roles, Security Best Practices, Storage Inventory.