Troubleshooting

Start with the basics

1. Check where you are. Everything in the portal works inside the boundary selected at the top of the sidebar. Make sure it is the boundary — and the resource group — the resource is in.
2. Check what you may do. A refused action (403 from the API) means none of your roles grants it at that scope. Ask an owner of the boundary for the role you need.
3. Look at the resource. Its status, its Operations tab and, where the resource has them, its logs and metrics usually say what went wrong. See Operations.

Deployment problems

• Open the failed operation: its message and the step that failed usually name the cause.
• Read the build or deployment log where the resource has one.
• Check the selected deployment source, repository, branch, runtime and compute plan.
• Check that the deployment source's credential still works — see Deployment sources.

Access problems

• Check which identity is acting. A pipeline acts as its service account, not as you; stsh whoami shows who the CLI is signed in as.
• Deny assignments win. A deny assignment blocks its actions for its principals whatever roles they hold, Owner included.
• Just-in-time access ends at its expiry time.
• Changes take a moment. A new or removed role assignment, deny assignment or just-in-time grant can take up to half a minute to affect permission checks.

Data and secret problems

• Check that you are using the right vault, secret name or database.
• Check whether a secret or credential was rotated or changed recently: workloads read secrets when they start, so a running workload keeps the value it started with until it restarts.

When you contact support

Include:

• the correlationId from the error response, or the time and the action you took — see Errors;
• the boundary, resource group and resource;
• the platform version, shown on your Settings page under System information.