Related command
az apim update --name "xxxxx" --resource-group "xxxxx" --sku-name "xxxx"
Is your feature request related to a problem? Please describe.
Scenario: APIM with VNET Injection
When you want to perform some update operation into the APIM such as change the SKU and you only have RBAC permissions on the APIM, you cannot update it due permissions missing as below
Code: LinkedAuthorizationFailed Message: The client 'xxxxx@xxxxxx.com' with object id 'xxxxxx-xxxxx-xxxxx-xxxx-xxxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxxx-xxxx-xxx-xxxxx-xxxxx/resourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxxx/resourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid. cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7f16fc097640>]
This previous error appears because the "az apim" use a PUT method to perform the update and to complete the PUT you need to have permissions in all the subproperties configured at APIM level.
Describe the solution you'd like
We would like to have a PATCH operation for the "az apim update" command same as you can perform over the REST API on next link https://docs.microsoft.com/en-us/rest/api/apimanagement/current-ga/api-management-service/update?tabs=HTTP
Describe alternatives you've considered
There is currently a command which one have both options to perform the update, it the "customlocations" on next link https://docs.microsoft.com/en-us/cli/azure/customlocation?view=azure-cli-latest
Additional context
From "customlocations" You can patch or update as you can see on next image
Full Output from "az apim update" command without permissions on VNET
`PS /home/jose> az apim update --name "apimtestnodel" --resource-group "moftest" --sku-name Premium --debug
cli.knack.cli: Command arguments: ['apim', 'update', '--name', 'apimtestnodel', '--resource-group', 'moftest', '--sku-name', 'Premium', '--debug']
cli.knack.cli: init debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7f16fcc2bbe0>, <function OutputProducer.on_global_arguments at 0x7f16fc9844c0>, <function CLIQuery.on_global_arguments at 0x7f16fc9b16c0>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'apim': ['azure.cli.command_modules.apim']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: apim 0.005 11 60
cli.azure.cli.core: Total (1) 0.005 11 60
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name Load Time Groups Commands Directory
cli.azure.cli.core: ai-examples 0.130 1 1 /opt/az/lib/python3.10/site-packages/azure-cli-extensions/ai-examples
cli.azure.cli.core: Total (1) 0.130 1 1
cli.azure.cli.core: Loaded 12 groups, 61 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : apim update
cli.azure.cli.core: Command table: apim update
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7f16fc097400>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/jose/.azure/commands/2022-08-03.14-49-55.apim_update.429.log'.
az_command_data_logger: command args: apim update --name {} --resource-group {} --sku-name {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x7f16fbeace50>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x7f16fbf692d0>, <function register_cache_arguments..add_cache_arguments at 0x7f16fbf693f0>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7f16fc984550>, <function CLIQuery.handle_query_parameter at 0x7f16fc9b1750>, <function register_ids_argument..parse_ids_arguments at 0x7f16fbf69360>]
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ApiManagementClient
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.auth.adal_authentication: MSIAuthenticationWrapper.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.auth.adal_authentication: Normalize expires_on: '1659541738' -> 1659541738
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel?api-version=2021-08-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '89aaf520-133b-11ed-b2df-66e4c4ec8d24'
cli.azure.cli.core.sdk.policies: 'CommandName': 'apim update'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--name --resource-group --sku-name --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.38.0 (DEB) azsdk-python-mgmt-apimanagement/3.0.0 Python/3.10.5 (Linux-5.4.0-1086-azure-x86_64-with-glibc2.28) cloud-shell/1.0'
cli.azure.cli.core.sdk.policies: 'Authorization': ''
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel?api-version=2021-08-01 HTTP/1.1" 200 None
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Transfer-Encoding': 'chunked'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Content-Encoding': 'gzip'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'ETag': '"AAAAAAA3djo="'
cli.azure.cli.core.sdk.policies: 'Vary': 'Accept-Encoding'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '9a7d68eb-7e44-4c49-9305-090054876a60'
cli.azure.cli.core.sdk.policies: 'Server': 'Microsoft-HTTPAPI/2.0'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '11999'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '9a7d68eb-7e44-4c49-9305-090054876a60'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20220803T144958Z:9a7d68eb-7e44-4c49-9305-090054876a60'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 03 Aug 2022 14:49:57 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"id":"/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel","name":"apimtestnodel","type":"Microsoft.ApiManagement/service","tags":{},"location":"West US","etag":"AAAAAAA3djo=","properties":{"publisherEmail":"louay@louay.com","publisherName":"louay","notificationSenderEmail":"apimgmt-noreply@mail.windowsazure.com","provisioningState":"Succeeded","targetProvisioningState":"","createdAtUtc":"2022-06-30T11:50:16.7472127Z","gatewayUrl":"https://apimtestnodel.azure-api.net","gatewayRegionalUrl":"https://apimtestnodel-westus-01.regional.azure-api.net","portalUrl":"https://apimtestnodel.portal.azure-api.net","developerPortalUrl":"https://apimtestnodel.developer.azure-api.net","managementApiUrl":"https://apimtestnodel.management.azure-api.net","scmUrl":"https://apimtestnodel.scm.azure-api.net","hostnameConfigurations":[{"type":"Proxy","hostName":"apimtestnodel.azure-api.net","encodedCertificate":null,"keyVaultId":null,"certificatePassword":null,"negotiateClientCertificate":false,"certificate":null,"defaultSslBinding":true,"identityClientId":null,"certificateSource":"BuiltIn","certificateStatus":null}],"publicIPAddresses":["20.253.136.48"],"privateIPAddresses":null,"additionalLocations":null,"virtualNetworkConfiguration":{"subnetResourceId":"/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub","vnetid":"00000000-0000-0000-0000-000000000000","subnetname":null},"customProperties":{"Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Protocols.Server.Http2":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30":"false"},"virtualNetworkType":"External","certificates":null,"disableGateway":false,"apiVersionConstraint":{"minApiVersion":null},"publicIpAddressId":"/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/publicIPAddresses/apimtestnodel","publicNetworkAccess":"Enabled","privateEndpointConnections":null,"platformVersion":"stv2"},"sku":{"name":"Developer","capacity":1},"identity":null,"zones":null,"systemData":{"createdBy":"loqadura@microsoft.com","createdByType":"User","createdAt":"2022-06-30T11:50:16.4563467Z","lastModifiedBy":"xxxx@xxxx.com","lastModifiedByType":"User","lastModifiedAt":"2022-07-29T11:10:16.7014413Z"}}
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ApiManagementClient
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ApiManagementClient
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.auth.adal_authentication: MSIAuthenticationWrapper.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.auth.adal_authentication: Normalize expires_on: '1659541738' -> 1659541738
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel?api-version=2021-08-01'
cli.azure.cli.core.sdk.policies: Request method: 'PUT'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json'
cli.azure.cli.core.sdk.policies: 'Content-Length': '1600'
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '89aaf520-133b-11ed-b2df-66e4c4ec8d24'
cli.azure.cli.core.sdk.policies: 'CommandName': 'apim update'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--name --resource-group --sku-name --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.38.0 (DEB) azsdk-python-mgmt-apimanagement/3.0.0 Python/3.10.5 (Linux-5.4.0-1086-azure-x86_64-with-glibc2.28) cloud-shell/1.0'
cli.azure.cli.core.sdk.policies: 'Authorization': ''
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: {"tags": {}, "sku": {"name": "Premium", "capacity": 1}, "location": "West US", "properties": {"notificationSenderEmail": "apimgmt-noreply@mail.windowsazure.com", "hostnameConfigurations": [{"type": "Proxy", "hostName": "apimtestnodel.azure-api.net", "defaultSslBinding": true, "negotiateClientCertificate": false, "certificateSource": "BuiltIn"}], "publicIpAddressId": "/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/publicIPAddresses/apimtestnodel", "publicNetworkAccess": "Enabled", "virtualNetworkConfiguration": {"subnetResourceId": "/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub"}, "customProperties": {"Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Protocols.Server.Http2": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30": "false"}, "disableGateway": false, "virtualNetworkType": "External", "apiVersionConstraint": {}, "publisherEmail": "louay@louay.com", "publisherName": "louay"}}
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "PUT /subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel?api-version=2021-08-01 HTTP/1.1" 403 643
cli.azure.cli.core.sdk.policies: Response status: 403
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'x-ms-failure-cause': 'gateway'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '37e847bb-6fa3-4dd0-9dd1-0576e07bf321'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '37e847bb-6fa3-4dd0-9dd1-0576e07bf321'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20220803T144959Z:37e847bb-6fa3-4dd0-9dd1-0576e07bf321'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 03 Aug 2022 14:49:58 GMT'
cli.azure.cli.core.sdk.policies: 'Connection': 'close'
cli.azure.cli.core.sdk.policies: 'Content-Length': '643'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"error":{"code":"LinkedAuthorizationFailed","message":"The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid."}}
cli.azure.cli.core.util: azure.cli.core.util.handle_exception is called with an exception:
cli.azure.cli.core.util: Traceback (most recent call last):
File "/opt/az/lib/python3.10/site-packages/knack/cli.py", line 231, in invoke
cmd_result = self.invocation.execute(args)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 663, in execute
raise ex
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 726, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 697, in _run_job
result = cmd_copy(params)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 333, in call
return self.handler(*args, **kwargs)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/command_operation.py", line 240, in handler
result = cached_put(self.cmd, setter, **setterargs)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 452, in cached_put
return _put_operation()
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 446, in _put_operation
result = operation(**kwargs)
File "/opt/az/lib/python3.10/site-packages/azure/core/tracing/decorator.py", line 73, in wrapper_use_tracer
return func(*args, **kwargs)
File "/opt/az/lib/python3.10/site-packages/azure/mgmt/apimanagement/operations/_api_management_service_operations.py", line 845, in begin_create_or_update
raw_result = self._create_or_update_initial(
File "/opt/az/lib/python3.10/site-packages/azure/mgmt/apimanagement/operations/_api_management_service_operations.py", line 788, in _create_or_update_initial
raise HttpResponseError(response=response, error_format=ARMErrorFormat)
azure.core.exceptions.HttpResponseError: (LinkedAuthorizationFailed) The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
Code: LinkedAuthorizationFailed
Message: The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
cli.azure.cli.core.azclierror: (LinkedAuthorizationFailed) The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
Code: LinkedAuthorizationFailed
Message: The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
az_command_data_logger: (LinkedAuthorizationFailed) The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
Code: LinkedAuthorizationFailed
Message: The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7f16fc097640>]
az_command_data_logger: exit code: 1
cli.main: Command ran in 4.022 seconds (init: 0.117, invoke: 3.905)
telemetry.save: Save telemetry record of length 4305 in cache
telemetry.check: Negative: The /home/jose/.azure/telemetry.txt was modified at 2022-08-03 14:46:53.762450, which in less than 600.000000 s`
Related command
az apim update --name "xxxxx" --resource-group "xxxxx" --sku-name "xxxx"Is your feature request related to a problem? Please describe.
Scenario: APIM with VNET Injection
When you want to perform some update operation into the APIM such as change the SKU and you only have RBAC permissions on the APIM, you cannot update it due permissions missing as below
Code: LinkedAuthorizationFailed Message: The client 'xxxxx@xxxxxx.com' with object id 'xxxxxx-xxxxx-xxxxx-xxxx-xxxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxxx-xxxx-xxx-xxxxx-xxxxx/resourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxxx/resourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid. cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7f16fc097640>]This previous error appears because the "az apim" use a PUT method to perform the update and to complete the PUT you need to have permissions in all the subproperties configured at APIM level.
Describe the solution you'd like
We would like to have a PATCH operation for the "az apim update" command same as you can perform over the REST API on next link https://docs.microsoft.com/en-us/rest/api/apimanagement/current-ga/api-management-service/update?tabs=HTTP
Describe alternatives you've considered
There is currently a command which one have both options to perform the update, it the "customlocations" on next link https://docs.microsoft.com/en-us/cli/azure/customlocation?view=azure-cli-latest
Additional context
From "customlocations" You can patch or update as you can see on next image
Full Output from "az apim update" command without permissions on VNET
`PS /home/jose> az apim update --name "apimtestnodel" --resource-group "moftest" --sku-name Premium --debug
cli.knack.cli: Command arguments: ['apim', 'update', '--name', 'apimtestnodel', '--resource-group', 'moftest', '--sku-name', 'Premium', '--debug']
cli.knack.cli: init debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7f16fcc2bbe0>, <function OutputProducer.on_global_arguments at 0x7f16fc9844c0>, <function CLIQuery.on_global_arguments at 0x7f16fc9b16c0>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'apim': ['azure.cli.command_modules.apim']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: apim 0.005 11 60
cli.azure.cli.core: Total (1) 0.005 11 60
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name Load Time Groups Commands Directory
cli.azure.cli.core: ai-examples 0.130 1 1 /opt/az/lib/python3.10/site-packages/azure-cli-extensions/ai-examples
cli.azure.cli.core: Total (1) 0.130 1 1
cli.azure.cli.core: Loaded 12 groups, 61 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : apim update
cli.azure.cli.core: Command table: apim update
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7f16fc097400>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/jose/.azure/commands/2022-08-03.14-49-55.apim_update.429.log'.
az_command_data_logger: command args: apim update --name {} --resource-group {} --sku-name {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x7f16fbeace50>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x7f16fbf692d0>, <function register_cache_arguments..add_cache_arguments at 0x7f16fbf693f0>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7f16fc984550>, <function CLIQuery.handle_query_parameter at 0x7f16fc9b1750>, <function register_ids_argument..parse_ids_arguments at 0x7f16fbf69360>]
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ApiManagementClient
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.auth.adal_authentication: MSIAuthenticationWrapper.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.auth.adal_authentication: Normalize expires_on: '1659541738' -> 1659541738
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel?api-version=2021-08-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '89aaf520-133b-11ed-b2df-66e4c4ec8d24'
cli.azure.cli.core.sdk.policies: 'CommandName': 'apim update'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--name --resource-group --sku-name --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.38.0 (DEB) azsdk-python-mgmt-apimanagement/3.0.0 Python/3.10.5 (Linux-5.4.0-1086-azure-x86_64-with-glibc2.28) cloud-shell/1.0'
cli.azure.cli.core.sdk.policies: 'Authorization': ''
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel?api-version=2021-08-01 HTTP/1.1" 200 None
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Transfer-Encoding': 'chunked'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Content-Encoding': 'gzip'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'ETag': '"AAAAAAA3djo="'
cli.azure.cli.core.sdk.policies: 'Vary': 'Accept-Encoding'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '9a7d68eb-7e44-4c49-9305-090054876a60'
cli.azure.cli.core.sdk.policies: 'Server': 'Microsoft-HTTPAPI/2.0'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '11999'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '9a7d68eb-7e44-4c49-9305-090054876a60'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20220803T144958Z:9a7d68eb-7e44-4c49-9305-090054876a60'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 03 Aug 2022 14:49:57 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"id":"/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel","name":"apimtestnodel","type":"Microsoft.ApiManagement/service","tags":{},"location":"West US","etag":"AAAAAAA3djo=","properties":{"publisherEmail":"louay@louay.com","publisherName":"louay","notificationSenderEmail":"apimgmt-noreply@mail.windowsazure.com","provisioningState":"Succeeded","targetProvisioningState":"","createdAtUtc":"2022-06-30T11:50:16.7472127Z","gatewayUrl":"https://apimtestnodel.azure-api.net","gatewayRegionalUrl":"https://apimtestnodel-westus-01.regional.azure-api.net","portalUrl":"https://apimtestnodel.portal.azure-api.net","developerPortalUrl":"https://apimtestnodel.developer.azure-api.net","managementApiUrl":"https://apimtestnodel.management.azure-api.net","scmUrl":"https://apimtestnodel.scm.azure-api.net","hostnameConfigurations":[{"type":"Proxy","hostName":"apimtestnodel.azure-api.net","encodedCertificate":null,"keyVaultId":null,"certificatePassword":null,"negotiateClientCertificate":false,"certificate":null,"defaultSslBinding":true,"identityClientId":null,"certificateSource":"BuiltIn","certificateStatus":null}],"publicIPAddresses":["20.253.136.48"],"privateIPAddresses":null,"additionalLocations":null,"virtualNetworkConfiguration":{"subnetResourceId":"/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub","vnetid":"00000000-0000-0000-0000-000000000000","subnetname":null},"customProperties":{"Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Protocols.Server.Http2":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168":"false","Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30":"false"},"virtualNetworkType":"External","certificates":null,"disableGateway":false,"apiVersionConstraint":{"minApiVersion":null},"publicIpAddressId":"/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/publicIPAddresses/apimtestnodel","publicNetworkAccess":"Enabled","privateEndpointConnections":null,"platformVersion":"stv2"},"sku":{"name":"Developer","capacity":1},"identity":null,"zones":null,"systemData":{"createdBy":"loqadura@microsoft.com","createdByType":"User","createdAt":"2022-06-30T11:50:16.4563467Z","lastModifiedBy":"xxxx@xxxx.com","lastModifiedByType":"User","lastModifiedAt":"2022-07-29T11:10:16.7014413Z"}}
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ApiManagementClient
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ApiManagementClient
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.auth.adal_authentication: MSIAuthenticationWrapper.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
urllib3.connectionpool: Starting new HTTP connection (1): localhost:50342
urllib3.connectionpool: http://localhost:50342 "POST /oauth2/token HTTP/1.1" 200 2294
msrestazure.azure_active_directory: MSI: Retrieving a token from http://localhost:50342/oauth2/token, with payload {'resource': 'https://management.core.windows.net/'}
cli.azure.cli.core.auth.adal_authentication: Normalize expires_on: '1659541738' -> 1659541738
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel?api-version=2021-08-01'
cli.azure.cli.core.sdk.policies: Request method: 'PUT'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json'
cli.azure.cli.core.sdk.policies: 'Content-Length': '1600'
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': '89aaf520-133b-11ed-b2df-66e4c4ec8d24'
cli.azure.cli.core.sdk.policies: 'CommandName': 'apim update'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--name --resource-group --sku-name --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.38.0 (DEB) azsdk-python-mgmt-apimanagement/3.0.0 Python/3.10.5 (Linux-5.4.0-1086-azure-x86_64-with-glibc2.28) cloud-shell/1.0'
cli.azure.cli.core.sdk.policies: 'Authorization': ''
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: {"tags": {}, "sku": {"name": "Premium", "capacity": 1}, "location": "West US", "properties": {"notificationSenderEmail": "apimgmt-noreply@mail.windowsazure.com", "hostnameConfigurations": [{"type": "Proxy", "hostName": "apimtestnodel.azure-api.net", "defaultSslBinding": true, "negotiateClientCertificate": false, "certificateSource": "BuiltIn"}], "publicIpAddressId": "/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/publicIPAddresses/apimtestnodel", "publicNetworkAccess": "Enabled", "virtualNetworkConfiguration": {"subnetResourceId": "/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub"}, "customProperties": {"Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls11": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Tls10": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls11": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Tls10": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Backend.Protocols.Ssl30": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Protocols.Server.Http2": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Ciphers.TripleDes168": "false", "Microsoft.WindowsAzure.ApiManagement.Gateway.Security.Protocols.Ssl30": "false"}, "disableGateway": false, "virtualNetworkType": "External", "apiVersionConstraint": {}, "publisherEmail": "louay@louay.com", "publisherName": "louay"}}
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "PUT /subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel?api-version=2021-08-01 HTTP/1.1" 403 643
cli.azure.cli.core.sdk.policies: Response status: 403
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'x-ms-failure-cause': 'gateway'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '37e847bb-6fa3-4dd0-9dd1-0576e07bf321'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '37e847bb-6fa3-4dd0-9dd1-0576e07bf321'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20220803T144959Z:37e847bb-6fa3-4dd0-9dd1-0576e07bf321'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 03 Aug 2022 14:49:58 GMT'
cli.azure.cli.core.sdk.policies: 'Connection': 'close'
cli.azure.cli.core.sdk.policies: 'Content-Length': '643'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"error":{"code":"LinkedAuthorizationFailed","message":"The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid."}}
cli.azure.cli.core.util: azure.cli.core.util.handle_exception is called with an exception:
cli.azure.cli.core.util: Traceback (most recent call last):
File "/opt/az/lib/python3.10/site-packages/knack/cli.py", line 231, in invoke
cmd_result = self.invocation.execute(args)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 663, in execute
raise ex
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 726, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 697, in _run_job
result = cmd_copy(params)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 333, in call
return self.handler(*args, **kwargs)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/command_operation.py", line 240, in handler
result = cached_put(self.cmd, setter, **setterargs)
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 452, in cached_put
return _put_operation()
File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/init.py", line 446, in _put_operation
result = operation(**kwargs)
File "/opt/az/lib/python3.10/site-packages/azure/core/tracing/decorator.py", line 73, in wrapper_use_tracer
return func(*args, **kwargs)
File "/opt/az/lib/python3.10/site-packages/azure/mgmt/apimanagement/operations/_api_management_service_operations.py", line 845, in begin_create_or_update
raw_result = self._create_or_update_initial(
File "/opt/az/lib/python3.10/site-packages/azure/mgmt/apimanagement/operations/_api_management_service_operations.py", line 788, in _create_or_update_initial
raise HttpResponseError(response=response, error_format=ARMErrorFormat)
azure.core.exceptions.HttpResponseError: (LinkedAuthorizationFailed) The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
Code: LinkedAuthorizationFailed
Message: The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
cli.azure.cli.core.azclierror: (LinkedAuthorizationFailed) The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
Code: LinkedAuthorizationFailed
Message: The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
az_command_data_logger: (LinkedAuthorizationFailed) The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
Code: LinkedAuthorizationFailed
Message: The client 'xxxx@xxxx.com' with object id 'xxxxx-xxxx-xxxxx-xxxxx' has permission to perform action 'Microsoft.ApiManagement/service/write' on scope '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.ApiManagement/service/apimtestnodel'; however, it does not have permission to perform action 'join/action' on the linked scope(s) '/subscriptions/xxxxxx-xx-xxxx-xxxx-xxxxxxresourceGroups/moftest/providers/Microsoft.Network/virtualNetworks/moftest-vnet/subnets/apimsub' or the linked scope(s) are invalid.
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7f16fc097640>]
az_command_data_logger: exit code: 1
cli.main: Command ran in 4.022 seconds (init: 0.117, invoke: 3.905)
telemetry.save: Save telemetry record of length 4305 in cache
telemetry.check: Negative: The /home/jose/.azure/telemetry.txt was modified at 2022-08-03 14:46:53.762450, which in less than 600.000000 s`