How to get permission to artefact store?

Nikhil Sundarappa

Adding to the above response, one important point to highlight is that in Azure AON CNF/NFD publishing scenarios, this failure is typically not related to the AON service itself, but is strictly enforced by ACR RBAC and token-based authorization at runtime.

Also, since az aosm nfd publish performs multiple backend operations in sequence (image staging → import → repository validation), the failure may sometimes appear inconsistent (portal 401 vs CLI AuthorizationFailed), but both point to the same root cause: missing ACR data-plane + import permissions for the Entra ID identity being used in the session.

Another key aspect is that role assignment changes are not immediately reflected in existing CLI sessions. Even after IAM update, stale tokens may continue to fail until a fresh login is performed, and in some cases it may take a few minutes for role propagation across ACR data-plane.

Additionally, if the environment is using a shared or service principal identity for automation, it is important to ensure the role is assigned to the exact identity object (not a different app registration or user principal), as mismatched identity scope is a common reason for repeated failures.

Once correct RBAC is applied, token is refreshed, and identity propagation is completed, both the portal access and az aosm nfd publish operation should work successfully without authorization errors.

Nikhil Sundarappa - Based on the error messages and validation against Microsoft documentation, the issue is permission-related on the target Azure Container Registry (ACR). The Microsoft Entra identity referenced in the error does not currently have the required permissions on the target ACR.

• The portal Repositories blade returns 401 (Unauthorized) because the identity lacks data‑plane read permissions (for example, repository list/pull).
• The az aosm nfd publish command fails with AuthorizationFailed because it attempts an image import operation that requires the Microsoft.ContainerRegistry/registries/importImage/action permission.

Microsoft documentation confirms:

1. Access to ACR repositories requires appropriate authentication and pull/read permissions. [learn.microsoft.com]
2. The importImage operation is a control‑plane action that must be allowed by the assigned role. The Microsoft Entra identity referenced in the error does not currently have the required permissions on the target ACR.

The portal Repositories blade returns 401 (Unauthorized) because the identity lacks data‑plane read permissions (for example, repository list/pull).

The az aosm nfd publish command fails with AuthorizationFailed because it attempts an image import operation that requires the Microsoft.ContainerRegistry/registries/importImage/action permission.

Required Permissions (Validated) - To successfully execute az aosm nfd publish, the identity must have a role that includes:

• Microsoft.ContainerRegistry/registries/importImage/action
• Microsoft.ContainerRegistry/registries/pull/read
• Repository read/list permissions (data‑plane)

The built‑in role that explicitly covers these requirements is:

• Container Registry Data Importer and Data Reader
  • Includes: Import image (importImage/action)
    • Pull images (pull/read)
    • List repositories and metadata (catalog/read, etc.)

Additionally, broader roles such as:

• Contributor
• Owner

also include the importImage/action permission.

Since the registry is hosted in a managed (“hosted resources”) resource group, permission changes typically require an administrator.

Please request your subscription/platform administrator to:

1. Go to the target ACR resource
2. Open Access Control (IAM)
3. Assign one of the following roles to your identity:
   • Preferred (least privilege): Container Registry Data Importer and Data Reader
   • Alternative (broader access): Contributor or Owner
4. Scope can be limited to this ACR resource

After the role assignment is completed, refresh your authentication context:

az logout

az login

az account set --subscription <subscription-id>

This ensures the updated permissions are reflected in your token.

After the correct role is assigned and tokens are refreshed:

1. The Repositories blade in the Azure portal should load successfully (no 401 error)
2. The az aosm nfd publish command should complete successfully, including the image import step