A deployment stage fails when it tries to create an App Service, and the log says the caller lacks authorization on the resource group. The YAML parses and the agent is healthy. What is the likely root cause?
Show answer and explanation
Answer: D
An authorization failure from Azure means the identity behind the service connection, whether a service principal, managed identity, or federated credential, lacks an RBAC role granting the needed action at the scope being used. Assigning Contributor or a narrower custom role at the correct scope resolves it. A missing dependsOn causes ordering problems, soft delete concerns vault recovery, and queued runs produce waiting rather than permission errors.
Why the other options are wrong
- A. A missing dependsOn changes execution order, so the deploy stage would start too early, not receive a permission error from Azure.
- B. Soft delete protects deleted vault objects from permanent loss and does not block creating an App Service.
- C. A busy pool makes runs wait for an agent; it does not return an authorization message about a resource group.