Repository navigation
line "az ad sp create-for-rbac --role "Monitoring Reader" --scopes /subscriptions/{subscription_id}" issue #25516
Closed as not planned
Description
This is autogenerated. Please review and update as needed.
Describe the bug
Command Name
az ad sp create-for-rbac
Errors:
Creating 'Monitoring Reader' role assignment under scope '/subscriptions/{subscription_id}'
Role assignment creation failed.
The command failed with an unexpected error. Here is the traceback:
'subscription_id'
Traceback (most recent call last):
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
raise ex
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 718, in _run_job
return cmd_copy.exception_handler(ex)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/command_modules/role/commands.py", line 51, in graph_err_handler
raise ex
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
result = cmd_copy(params)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
return self.handler(*args, **kwargs)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
return op(**command_args)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/command_modules/role/custom.py", line 1246, in create_service_principal_for_rbac
_create_role_assignment(cmd.cli_ctx, role, sp_oid, None, scope, resolve_assignee=False,
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/command_modules/role/custom.py", line 200, in _create_role_assignment
role_id = _resolve_role_id(role, scope, definitions_client)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/cli/command_modules/role/custom.py", line 609, in _resolve_role_id
role_defs = list(definitions_client.list(scope, "roleName eq '{}'".format(role)))
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/msrest/paging.py", line 143, in __next__
self.advance_page()
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/msrest/paging.py", line 129, in advance_page
self._response = self._get_next(self.next_link)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/mgmt/authorization/v2018_01_01_preview/operations/_role_definitions_operations.py", line 285, in internal_paging
request = prepare_request(next_link)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/azure/mgmt/authorization/v2018_01_01_preview/operations/_role_definitions_operations.py", line 281, in prepare_request
request = self._client.get(url, query_parameters, header_parameters)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/msrest/service_client.py", line 168, in get
request = self._request('GET', url, params, headers, content, form_content)
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/msrest/service_client.py", line 108, in _request
request = ClientRequest(method, self.format_url(url))
File "/usr/local/Cellar/azure-cli/2.45.0/libexec/lib/python3.10/site-packages/msrest/service_client.py", line 151, in format_url
url = url.format(**kwargs)
KeyError: 'subscription_id'
To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.
- Put any pre-requisite steps here...
az ad sp create-for-rbac --name {} --role {} --scopes {} {}
Expected Behavior
Environment Summary
macOS-13.0.1-x86_64-i386-64bit, Darwin 22.1.0
Python 3.10.10
Installer: HOMEBREW
azure-cli 2.45.0
Activity
yonzhan commentedon Feb 20, 2023
Jiashuo Li (@jiasli) for awareness
MaddyMicrosoft commentedon Oct 9, 2026
This failure came from the older authorization SDK formatting the request URL, which raised an unhandled error when the scope still contained the literal {subscription_id} placeholder instead of a real subscription ID. The role module now uses a newer authorization SDK (azure-mgmt-authorization 5.x) that no longer takes that code path, so this traceback should no longer occur.
Closing as obsolete. If you still hit an unexpected error on a current Azure CLI with a real subscription ID in --scopes, please open a fresh issue with az --version and --debug output.