--- cuppy_hub: azure cuppy_path: reference/azd/errors.md cuppy_section: docs cuppy_doc: 1G1K-PC9S cuppy_doc_uuid: c645897f-cbd0-4f32-a5d5-5b32e9847c11 cuppy_permalink: https://cuppy.io/azure/d/1G1K-PC9S cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/azd/errors cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 0ca268f5d53ef7e4cf60d5917e102e3902fbf21f29106aeea6e585fa4a391c65 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Azure Developer CLI (azd) errors **`azd provision` is a Bicep deployment, so most of its failures are ARM errors with azd's wording around them.** The real error is in the resource group azd created (`rg-` in most templates) under **Deployments**, or through `guides/arm/debug-failed-deployment.md`. Re-run with `--debug` for azd's own trace, and redact it before sharing. **azd's state:** each environment is a folder under `.azure/` in the project (its `.env` holds `AZURE_ENV_NAME`, `AZURE_LOCATION`, `AZURE_SUBSCRIPTION_ID` and outputs). azd treats every folder in `.azure` as an environment, so don't run azd from your home directory, where the Azure CLI keeps its own `.azure`. ## Errors | Message | Cause → fix | Check | |---|---|---| | `… Authorization failed for template resource '' of type 'Microsoft.Authorization/roleAssignments'. The client '' with object id '' does not have permission to perform action 'Microsoft.Authorization/roleAssignments/write' …` | The template assigns roles (most azd templates do, for managed identities) and you have only Contributor. You need Owner, User Access Administrator or Role Based Access Control Administrator on the target scope; otherwise someone with it runs the first deployment | `az role assignment list --assignee --all --include-inherited -o table` | | `The role assignment already exists.` | Often intermittent: retry `azd up`. Templates should name role assignments with `guid()` | `reference/rbac/errors.md` | | `Tenant ID, application ID, principal ID, and scope are not allowed to be updated.` | The same role-assignment resource is now targeting a different principal (for example, switching between your user and a service principal). Delete the old assignment, or keep the principal stable | `az role assignment list --scope -o table` | | `The region '' currently does not have enough resources available to provision services with the SKU ''.` | Capacity, common for AI services in busy regions. `azd env set AZURE_LOCATION ` and provision again | `az account list-locations -o table` | | `This operation require new capacity in quota Tokens Per Minute (thousands) - - GlobalStandard, which is bigger than the current available capacity .` | Azure OpenAI model quota in that region (Azure OpenAI family) | Quota in the Foundry portal | | `The specified precondition 'If-Match = ""' failed.` | A concurrent update: another pipeline or person deploying the same environment, or resources the template updates in parallel. Retry; serialize deployments | Recent deployments in `rg-` | | `Call to Microsoft.CognitiveServices/accounts failed. Error message: Account in state Accepted.` | A dependent resource touched the account before it finished provisioning. Retry, or add a `postprovision` hook that waits | The account's `provisioningState` | | `ERROR: resolving '': AZURE_RESOURCE__ID is not set as an output variable` (`azd show`) | The resource isn't in `azure.yaml` under `resources:`, or isn't provisioned, or the template doesn't output its ID | The template's outputs; `azd env get-values` | | New role or subscription not seen by azd | azd caches credentials and permissions: `azd auth logout`, then `azd auth login` | — | | Bicep build errors from azd | azd installs its own Bicep; set `AZD_BICEP_TOOL_PATH` to use a specific build | `bicep --version` | | Region out of capacity / provider not present there | ARM capacity or provider errors | `reference/arm/errors.md` | ## When none of these fits Open the failed deployment in `rg-` and read its operations; the ARM catalogues (`reference/arm/deployment-errors.md`, `reference/arm/errors.md`) take it from there. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.