Authorization exception with Azure using C# and Microsoft.Azure.Management.Fluent

Question

I am a student and I am currently trying to learn Azure platform and how to use the C# libraries to manage it. I was able to create, delete blob and files with no problem using the package WindowsAzure.Storage.

Then I wanted to list VMs using this tutorial : https://docs.microsoft.com/en-us/azure/virtual-machines/windows/csharp

This is my code:

var credentials = SdkContext.AzureCredentialsFactory.FromFile(Environment.GetEnvironmentVariable("AZURE_AUTH_LOCATION"));

var azure = Azure
            .Configure()
            .WithLogLevel(HttpLoggingDelegatingHandler.Level.Basic)
            .Authenticate(credentials)
            .WithDefaultSubscription();

Console.WriteLine(azure.VirtualMachines.List().Count());

My connection file look like this:

subscription=********-****-****-****-************
client=********-****-****-****-************
key=qeFkWjPm0YHn5xw8UMS2ytLhf9Oi0rEMxZVOTpk3aMQ=
tenant=********-****-****-****-************
managementURI=https://management.core.windows.net/
baseURL=https://management.azure.com/
authURL=https://login.windows.net/
graphURL=https://graph.windows.net/

But I get this error:

Unhandled Exception: Microsoft.Rest.Azure.CloudException: The client '********-****-****-****-************' with object id '********-****-****-****-************' does not have authorization to perform action 'Microsoft.Compute/virtualMachines/read' over scope '/subscriptions/********-****-****-****-************'.

There is two weird things I noticed : 1 - In the exception message, the client id and object id are the same and I dont know where they come from. 2 - When I create a new application registration on AzureAD, I can't see it in "My apps" but only in "All Apps", and I cant add myself as an owner. Click here to see a screenshot

I have searched for 2 days and I cant figured out why it's not working. (This is a simple .Net Core 2 console project, I am on Linux if it can help to find out)

Thank you in advance.

Edit #1 :

Thank's to @juunas, working now. Help link: https://docs.microsoft.com/en-US/azure/azure-resource-manager/resource-group-create-service-principal-portal#assign-application-to-role

Answer 1

To read details about a VM, the application should have a Reader role on the VM, its resource group, or the subscription. If you need to modify things, Contributor allows all modifications. You should add the application to a role via the Access Control IAM tab on the subscription/resource group/resource.