Plan script shall fail if Policy assignments can not be read

[artisticcheese]

Hello,

I'm having weird issue with reading policy assignments after they are created on first run with the same SPN which created it.
Plan script shall fail instead of continuing execution in CI/CD in such cases.
Is there a bug in a code or how do I troubleshoot this RBAC issue which shall not be there (same SPN created assignment on first run)

[techlake]

Permissions are documented here: https://github.com/Azure/enterprise-azure-policy-as-code/blob/main/Docs/ci-cd-pipeline.md#ms-graph-permissions

In rare circumstances this error is not an error (it happens if a previous role assignment failed). I will add code to surface the error a second time at the end of the CI/CD step and clarify the error message with additional information.

[artisticcheese]

I think documentation need to have very details steps how to do Graph permissions step by step. For example which application I'm supposed to be providing MS Graph permissions?
There is generic documentation already but I think walkthrough would still be required as a lot of DevOps personnel frequently removed from Azure AD administration and identity management in general. In our case it's managed by completely different part of the company and reliance on MS Graph increase complexity of implementation of this project on another level.

[artisticcheese]

Is there an option just to forego somehow assignment management and do assignment management manually rather the automatically. It's worth for me to have one time manual steps rather then to deal with MS Graph.

[techlake]

Nope, always there. MSGraph is easy. Just follow the 3 linked steps in the documentation

[martyh888]

I think what is missing in the docs is the following from Docs/ci-cd-pipeline.md

sc-pac-dev also requires MS Graph Permissions (basically anything that is being used to query the Roles)

[techlake]

Thank you for finding this bug and a solution. I'll fix this soon. I tagged this issue with Documentation