Azure 'AuthorizationFailed: The client with object id does not have authorization to perform action over scope' (or 'or the scope is invalid') - how do I fix it?

Cause: Azure RBAC found no role assignment for the signed-in identity that includes the needed action at the target scope (or a parent scope). Microsoft's troubleshooting guide gives the main reason as the user not having write permission to the resource at the selected scope. Other causes: you are signed in as the wrong account or tenant, the scope or subscription ID is wrong ("or the scope is invalid"), a guest user was not given a role, a recently added role assignment is not yet effective, or the role assignment has an ABAC condition that does not match. Fix: 1. Check who and where you are: az account show (tenant, subscription, user) and confirm the subscription and resource group in the error exist and are the ones you intended; set one with az account set --subscription SUBSCRIPTION_ID. 2. List your assignments at the scope: az role assignment list --assignee USER_OR_OBJECT_ID --scope /subscriptions/SUBSCRIPTION_ID/resourceGroups/RG_NAME --include-inherited. (Use the object ID of a service principal, not the application ID.) 3. Grant the least-privileged role that contains the action at the narrowest scope that works, for example Virtual Machine Contributor on the resource group for managing VMs. Command shape: az role assignment create --assignee OBJECT_ID --role "ROLE_NAME_OR_ID" --scope SCOPE. You need Microsoft.Authorization/roleAssignments/write at that scope, for example through Role Based Access Control Administrator. Prefer role IDs in automation because names can change. 4. Do not hand out Owner or subscription-wide Contributor just to clear the error. 5. After a change, allow time: role assignment changes can take up to 10 minutes. Force a refresh by signing out and in (az logout, az login) or by obtaining a new access token. For managed identities added through groups, changes can take hours. 6. If a service principal in a script gets "Insufficient privileges" when assigning roles with --assignee, use --assignee-object-id (and --assignee-principal-type) to skip the directory lookup, or give it the Directory Readers role. 7. If assigning a role to a freshly created principal fails, set the principal type or wait for replication. Verify: re-run the failing command; az role assignment list shows the expected role at the intended scope, and the operation succeeds. Sources: https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-cli