I have delegated access to Azure resources in a third-party tenant using Lighthouse, and this works fine via the portal; users receive the roles expected (typically Contributor).

However, they are unable to access Kudu (at webappname.scm.azurewebsites.net), receiving an error;

Selected user account does not exist in tenant 'Tenant Name' and cannot access the application 'abfa0a7c-a6b6-4736-8310-5855508787cd' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.

If the same user account is added as a guest to the third-party tenant and given the same role, they can access Kudu as expected.

It's clear that Kudu is expecting/demanding an account in the same tenant as the application, but Azure Lighthouse delegated permissions is all about not having to do that.

Is there something I'm missing, or another role that needs granting?

CodePudding user response：

@PhilD, Thanks for the detailed description of the scenario. I have also posted this on your Q&A thread.

Currently, Kudu is not compatible with Lighthouse-delegated permissions.

Our product engineering team is working on it; however, we do not have an exact ETA to share. We’re expecting it to be available in a few months. Please note that this timeline is just an estimate and is subject to change, depending on a myriad of factors.

I have relayed the feedback internally to our product engineering team and it’s being tracked.

-On a side note, as mentioned in this Kudu wiki : “Only those with Contributor / Owner access (to be exact, with microsoft.web/sites/publish/action or, for slot, microsoft.web/sites/slots/publish/action) can access to Kudu (SCM).”

Much appreciate your valuable feedback on this. Thanks for your patience!