Azure Cloud Account data collection fails with Suspended state and AuthorizationFailed 403 error in VMware Aria Automation

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

In VMware Aria Automation, an Azure Cloud Account fails to connect or synchronize images. You may observe the following error messages in the Cloud Account configuration UI: 

• Data collection failed: Failed to send enum request. Endpoint [/resources/endpoints/...] is in SUSPENDED state

• Image synchronization failed: com.microsoft.azure.CloudException: Status code 403, {"error":{"code":"AuthorizationFailed","message":"The client '...' does not have authorization to perform action 'Microsoft.Compute/images/read'..."}}

Environment

Aria Automation 8.x

Cause

This issue occurs due to two concurrent factors: 

1. The "Suspended" state is a known condition where data collection is halted after repeated failures. 
2. The AuthorizationFailed error is caused by missing permissions or role assignments on the Azure side, specifically for the "Microsoft.Compute/images/read" action over the designated subscription scope.

Resolution

To resolve this issue, you must address the Azure permissions and then clear the suspended state:

1. Update Azure Permissions: Log in to the Azure Portal and ensure the Service Principal used by Aria Automation has the necessary role assignments. Specifically, verify it has permission to perform Microsoft.Compute/images/read for the affected subscription.

2. Clear Suspended State: Follow the steps outlined in KB 377182 to address the suspended endpoint.

3. Validate Credentials: In the Aria Automation Cloud Account configuration, re-enter and validate the credentials to trigger a fresh data collection cycle.