Workaround for azd up permission issues - insufficient Azure subscription privileges

[amosinha]

I've successfully completed the infrastructure provisioning (azd up) and have been regularly updating with azd deploy for both backend and frontend.

I'm trying to set up login and acl now but running into permission issues with azd up.

Current Issue:
Cannot run azd up due to insufficient permissions on Azure subscription
Need to provision the required Azure resources but don't have Owner/Contributor access at subscription level

Questions:
Alternative deployment methods: Are there any workarounds to deploy without azd up? Can I manually provision resources and then use existing infrastructure?

Minimal permissions approach: What's the minimum set of Azure permissions needed? Can this work with just resource group-level permissions?

Pre-provisioned setup: Is there a way to use existing Azure OpenAI, Cognitive Search, and App Service resources instead of letting azd create new ones?

[amosinha]

@pamelafox Hi Pamela, your input would be really helpful!

[pamelafox]

This is what we suggest in the README:

If you don't have subscription-level permissions, you must be granted RBAC for an existing resource group and deploy to that existing group.

Are you able to do that?

[pamelafox]

Oh hm, I see that you're only getting this error once you enable the login feature? Is the error tied to a particular resource/deployment step?

[amosinha]

Hi Pamela! Thanks for the response. The permission error occurs specifically when trying to enable authentication features. I've already manually configured managed identity through the Azure portal according to the login and acl doc.

azd deploy works perfectly for code updates, but azd up fails when authentication is enabled due to subscription-level permission requirements. I don't have subscription level access.

After manual managed identity setup, is there an alternative way to enable the authentication features without requiring azd up? Can I configure the remaining auth components through Azure portal or environment variables?

[pamelafox]

If its just the auth app registrations, then there is a manual setup guide:
https://github.com/Azure-Samples/azure-search-openai-demo/blob/main/docs/login_and_acl.md#manual-setup

But that assumes you're running "azd provision" to get the resources and RBAC roles setup. If you're doing everything manually, then you need to look at main.bicep to see everything that's enabled when useAuthentication is true.