New-AzServiceBusAuthorizationRule cannot create a rule with Listen only rights

[jeremybeavon]

Description

When trying to create a service bus authorization rule with the only rights being Listen, it fails with the following error:

New-AzServiceBusAuthorizationRule : Assigning 'Manage' to rights requires ‘Listen and ‘Send' to be included with. e.g.
@("Manage","Listen","Send")

It is possible to create a authorization rule with these rights in the portal, but not using powershell.

Steps to reproduce

New-AzServiceBusAuthorizationRule `
        -ResourceGroupName "myResourceGroup" `
        -Namespace "myservicebus" `
        -Queue "myqueue" `
        -Name Receiver `
        -Rights @("Listen")

Environment data

Name                           Value
----                           -----
PSVersion                      5.1.17134.858
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.17134.858
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Module versions

Script     1.6.1      Az.Accounts                         {Disable-AzDataCollection, Disable-AzContextAutosave, Enab...
Script     1.0.0      Az.Advisor                          {Get-AzAdvisorRecommendation, Enable-AzAdvisorRecommendati...
Script     1.0.1      Az.Aks                              {Get-AzAks, New-AzAks, Remove-AzAks, Import-AzAksCredentia...
Script     1.1.0      Az.AnalysisServices                 {Resume-AzAnalysisServicesServer, Suspend-AzAnalysisServic...
Script     1.2.0      Az.ApiManagement                    {Add-AzApiManagementApiToProduct, Add-AzApiManagementProdu...
Script     1.0.1      Az.ApplicationInsights              {Get-AzApplicationInsights, New-AzApplicationInsights, Rem...
Script     1.3.1      Az.Automation                       {Get-AzAutomationHybridWorkerGroup, Remove-AzAutomationHyb...
Script     1.1.0      Az.Batch                            {Remove-AzBatchAccount, Get-AzBatchAccount, Get-AzBatchAcc...
Script     1.0.0      Az.Billing                          {Get-AzBillingInvoice, Get-AzBillingPeriod, Get-AzEnrollme...
Script     1.3.0      Az.Cdn                              {Get-AzCdnProfile, Get-AzCdnProfileSsoUrl, New-AzCdnProfil...
Script     1.2.0      Az.CognitiveServices                {Get-AzCognitiveServicesAccount, Get-AzCognitiveServicesAc...
Script     2.4.1      Az.Compute                          {Remove-AzAvailabilitySet, Get-AzAvailabilitySet, New-AzAv...
Script     1.0.1      Az.ContainerInstance                {New-AzContainerGroup, Get-AzContainerGroup, Remove-AzCont...
Script     1.1.0      Az.ContainerRegistry                {New-AzContainerRegistry, Get-AzContainerRegistry, Update-...
Script     1.1.3      Az.DataFactory                      {Set-AzDataFactoryV2, Update-AzDataFactoryV2, Get-AzDataFa...
Script     1.0.0      Az.DataLakeAnalytics                {Get-AzDataLakeAnalyticsDataSource, New-AzDataLakeAnalytic...
Script     1.2.1      Az.DataLakeStore                    {Get-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeSt...
Script     1.0.0      Az.DeploymentManager                {Get-AzDeploymentManagerArtifactSource, New-AzDeploymentMa...
Script     1.0.0      Az.DevTestLabs                      {Get-AzDtlAllowedVMSizesPolicy, Get-AzDtlAutoShutdownPolic...
Script     1.1.1      Az.Dns                              {Get-AzDnsRecordSet, New-AzDnsRecordConfig, Remove-AzDnsRe...
Script     1.2.1      Az.EventGrid                        {New-AzEventGridTopic, Get-AzEventGridTopic, Set-AzEventGr...
Script     1.3.0      Az.EventHub                         {New-AzEventHubNamespace, Get-AzEventHubNamespace, Set-AzE...
Script     1.1.0      Az.FrontDoor                        {New-AzFrontDoor, Get-AzFrontDoor, Set-AzFrontDoor, Remove...
Script     2.0.0      Az.HDInsight                        {Get-AzHDInsightJob, New-AzHDInsightSqoopJobDefinition, Wa...
Script     1.2.0      Az.IotHub                           {Add-AzIotHubKey, Get-AzIotHubEventHubConsumerGroup, Get-A...
Script     1.3.0      Az.KeyVault                         {Add-AzKeyVaultCertificate, Update-AzKeyVaultCertificate, ...
Script     1.3.0      Az.LogicApp                         {Get-AzIntegrationAccountAgreement, Get-AzIntegrationAccou...
Script     1.1.0      Az.MachineLearning                  {Move-AzMlCommitmentAssociation, Get-AzMlCommitmentAssocia...
Script     1.0.0      Az.ManagedServices                  {Get-AzManagedServicesAssignment, New-AzManagedServicesAss...
Script     1.0.0      Az.MarketplaceOrdering              {Get-AzMarketplaceTerms, Set-AzMarketplaceTerms}
Script     1.1.0      Az.Media                            {Sync-AzMediaServiceStorageKey, Set-AzMediaServiceKey, Get...
Script     1.2.1      Az.Monitor                          {Get-AzMetricDefinition, Get-AzMetric, Remove-AzLogProfile...
Script     1.12.0     Az.Network                          {Add-AzApplicationGatewayAuthenticationCertificate, Get-Az...
Script     1.1.0      Az.NotificationHubs                 {Get-AzNotificationHub, Get-AzNotificationHubAuthorization...
Script     1.3.2      Az.OperationalInsights              {New-AzOperationalInsightsAzureActivityLogDataSource, New-...
Script     1.1.2      Az.PolicyInsights                   {Get-AzPolicyEvent, Get-AzPolicyState, Get-AzPolicyStateSu...
Script     1.1.0      Az.PowerBIEmbedded                  {Remove-AzPowerBIWorkspaceCollection, Get-AzPowerBIWorkspa...
Script     1.4.3      Az.RecoveryServices                 {Get-AzRecoveryServicesBackupProperty, Get-AzRecoveryServi...
Script     1.1.0      Az.RedisCache                       {Remove-AzRedisCachePatchSchedule, New-AzRedisCacheSchedul...
Script     1.0.1      Az.Relay                            {New-AzRelayNamespace, Get-AzRelayNamespace, Set-AzRelayNa...
Script     1.6.1      Az.Resources                        {Get-AzProviderOperation, Remove-AzRoleAssignment, Get-AzR...
Script     1.3.0      Az.ServiceBus                       {New-AzServiceBusNamespace, Get-AzServiceBusNamespace, Set...
Script     1.1.1      Az.ServiceFabric                    {Add-AzServiceFabricApplicationCertificate, Add-AzServiceF...
Script     1.0.2      Az.SignalR                          {New-AzSignalR, Get-AzSignalR, Get-AzSignalRKey, New-AzSig...
Script     1.13.1     Az.Sql                              {Get-AzSqlDatabaseTransparentDataEncryption, Get-AzSqlData...
Script     1.5.1      Az.Storage                          {Get-AzStorageAccount, Get-AzStorageAccountKey, New-AzStor...
Script     1.2.0      Az.StorageSync                      {Invoke-AzStorageSyncCompatibilityCheck, New-AzStorageSync...
Script     1.0.0      Az.StreamAnalytics                  {Get-AzStreamAnalyticsFunction, Get-AzStreamAnalyticsDefau...
Script     1.0.1      Az.TrafficManager                   {Add-AzTrafficManagerCustomHeaderToEndpoint, Remove-AzTraf...
Script     1.4.0      Az.Websites                         {Get-AzAppServicePlan, Set-AzAppServicePlan, New-AzAppServ...

Debug output

DEBUG: 12:08:08 PM - NewAzureServiceBusAuthorizationRule begin processing with ParameterSet
'QueueAuthorizationRuleSet'.
DEBUG: 12:08:08 PM - using account id 'c4305c9b-d9ab-48c0-b306-fdc92ff8425c'...
New-AzServiceBusAuthorizationRule : Assigning 'Manage' to rights requires ‘Listen and ‘Send' to be included with. e.g.
@("Manage","Listen","Send")
At line:1 char:1
+ New-AzServiceBusAuthorizationRule -ResourceGroupName Luna -Namespace  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.Exceptio...ExecuteCmdlet():Exception) [New-AzServiceBusAuthorizationR
   ule], Exception
    + FullyQualifiedErrorId : Assigning 'Manage' to rights requires ‘Listen and ‘Send' to be included with. e.g. @("Ma
   nage","Listen","Send"),Microsoft.Azure.Commands.ServiceBus.Commands.NewAzureServiceBusAuthorizationRule

DEBUG: 12:08:08 PM - NewAzureServiceBusAuthorizationRule end processing.
DEBUG: 12:08:08 PM - NewAzureServiceBusAuthorizationRule end processing.

Error output

Message        : Assigning 'Manage' to rights requires ‘Listen and ‘Send' to be included with. e.g.
                 @("Manage","Listen","Send")
StackTrace     :    at Microsoft.Azure.Commands.ServiceBus.Commands.NewAzureServiceBusAuthorizationRule.ExecuteCmdlet()
Exception      : System.Exception
InvocationInfo : {New-AzServiceBusAuthorizationRule}
Line           : New-AzServiceBusAuthorizationRule -ResourceGroupName Luna -Namespace Luna-ServiceBus -Queue
                 $QueueName -Rights @("Listen") -Name "Test"
Position       : At line:1 char:1
                 + New-AzServiceBusAuthorizationRule -ResourceGroupName Luna -Namespace  ...
                 + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId      : 35

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @jfggdl

[markcowl]

@v-Ajnava Can you take a look?

[AnaghaPirangute]

Any update on the error above. I am facing similar issue with EventHub.

[v-Ajnava]

@jeremybeavon and @AnaghaPirangute we have fixed the issue and its in the release 2.6.0. can you please try with 2.6.0.

https://www.powershellgallery.com/packages/Az/2.6.0

closing the issue, please feel free to reopen if you have any questions.