Azure Function通过托管标识调用Data Factory时授权失败求助

错误详情 #

2024-06-06T11:17:08Z   [Error]   (AuthorizationFailed) The client 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' with object id 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' does not have authorization to perform action 'Microsoft.DataFactory/factories/pipelines/createRun/action' over scope '/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/MyResourceGroup/providers/Microsoft.DataFactory/factories/my_factory/pipelines/get_file' or the scope is invalid. If access was recently granted, please refresh your credentials.
Code: AuthorizationFailed
Message: The client 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' with object id 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX' does not have authorization to perform action 'Microsoft.DataFactory/factories/pipelines/createRun/action' over scope '/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourceGroups/ZM-D365-Integration-DEV/providers/Microsoft.DataFactory/factories/zm-predev-danaostoazureinvoice-df/pipelines/get_invoive_from_danaos' or the scope is invalid. If access was recently granted, please refresh your credentials.
2024-06-06T11:17:08Z   [Error]   Failed to create data factory job Failed to run pipeline get_invoive_from_danaos
2024-06-06T11:17:08Z   [Error]   Executed 'Functions.invoice' (Failed, Id=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX, Duration=1849ms)

已为Azure Function的托管标识配置Data Factory Contributor和Contributor权限，但仍触发授权失败。

排查步骤 #

1. 确认权限作用域匹配 #

• 检查权限是否分配到错误信息中指定的ADF实例、其所在资源组或订阅，而非其他无关资源。避免仅将权限分配到单个管道，ADF管道运行权限需覆盖工厂级别或更高层级。
• 核对错误中的作用域路径，确保无拼写错误（如资源组名、工厂名、管道名）。

2. 验证托管标识关联正确性 #

• 进入Azure Function的身份设置，确认启用的系统托管标识对象ID与错误信息中的object id完全一致。
• 若使用用户托管标识，检查代码中是否指定了正确的标识资源ID/客户端ID，而非系统托管标识。

3. 确认权限生效状态 #

• Azure RBAC权限通常需要5-15分钟生效，刚配置的话等待足够时间后重试。
• 在ADF实例的**访问控制(IAM)**中使用「检查访问权限」功能，输入托管标识的对象ID，选择Microsoft.DataFactory/factories/pipelines/createRun/action动作，验证是否存在允许权限。

4. 检查代码调用范围 #

• 确认Function代码中调用ADF管道时使用的资源ID与错误中的作用域一致，避免路径拼写错误。建议使用工厂级别的权限范围，示例：

  string scope = "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DataFactory/factories/{factoryName}";
  

5. 排查隐式权限限制 #

• 检查资源组或订阅是否存在拒绝分配（Deny Assignment），此类设置会覆盖允许权限。
• 确认托管标识是否属于被限制访问的Azure AD组，组权限可能影响单个标识的访问能力。

6. 测试自定义最小权限 #

• 尝试为托管标识创建自定义角色，仅包含Microsoft.DataFactory/factories/pipelines/createRun/action权限并分配到目标ADF实例，排除内置角色的隐性限制。

内容的提问来源于stack exchange，提问作者vrghost