title: Getting issue The request to create role assignment 'xxxx--x-x-x--x-x-x-xxxxxxx' is not valid. Role assignment scope must match the scope specified
body: <p>I am trying to create storage account, blob storage and then trying to create role on storage account. Below is the code storagedeploy.json:</p>
  
  <pre><code> {
        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
        "contentVersion": "1.0.0.0",
        "parameters": {
          "Project": {
            "type": "string",
            "metadata": {
              "description": "Project name"
            }
          },
          "Environment": {
            "type": "string",
            "metadata": {
              "description": "Project name"
            }
          },
          "location": {
            "type": "string",
            "metadata": {
              "description": "Location for all resources."
            }
          }
        },
        "variables": {
          "storageAccountName": "[toLower(concat(parameters('Project'), parameters('Environment'), uniqueString(resourceGroup().id)))]"
        },
        "resources": [
          {
            "type": "Microsoft.Storage/storageAccounts",
            "apiVersion": "2019-04-01",
            "name": "[variables('storageAccountName')]",
            "location": "[parameters('location')]",
            "sku": {
              "name": "Standard_LRS",
              "tier": "Standard"
            },
            "kind": "StorageV2",
            "properties": {
              "networkAcls": {
                "bypass": "AzureServices",
                "virtualNetworkRules": [],
                "ipRules": [],
                "defaultAction": "Allow"
              },
              "supportsHttpsTrafficOnly": true,
              "encryption": {
                "services": {
                  "file": {
                    "enabled": true
                  },
                  "blob": {
                    "enabled": true
                  }
                },
                "keySource": "Microsoft.Storage"
              },
              "accessTier": "Hot"
            }
          },
          {
            "type": "Microsoft.Storage/storageAccounts/blobServices",
            "apiVersion": "2019-04-01",
            "name": "[concat(variables('storageAccountName'), '/default')]",
            "dependsOn": [
              "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
            ],
            "properties": {
              "cors": {
                "corsRules": []
              },
              "deleteRetentionPolicy": {
                "enabled": false
              }
            }
          },
          {
            "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
            "apiVersion": "2019-04-01",
            "name": "[concat(variables('storageAccountName'), '/default/mycompany-project123-dev-data-store-ue1')]",
            "dependsOn": [
              "[resourceId('Microsoft.Storage/storageAccounts/blobServices', variables('storageAccountName'), 'default')]",
              "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
            ],
            "properties": {
              "publicAccess": "None"
            }
          },
          {
            "type": "Microsoft.Authorization/roleAssignments",
            "name": "[guid(resourceGroup().id)]",
            "apiVersion": "2019-04-01-preview",
            "dependsOn": [
              "[resourceId('Microsoft.Storage/storageAccounts/blobServices', variables('storageAccountName'), 'default')]",
              "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
            ],
            "properties": {
              "roleDefinitionId": "[concat(subscription().id, '/providers/Microsoft.Authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
              "principalId": "xxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxx",
              "scope": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
            }
          }
  
        ]
      }
  </code></pre>
  
  <p>on execution, i am getting below issue:</p>
  
  <pre><code>PS C:\work\azure\azure-devops\resourcetemplates\staticresources&gt; az group deployment create --resource-group myproject-devops --template-file .\storagedeploy.json
  Please provide string value for 'Project' (? for help): ert
  Please provide string value for 'Environment' (? for help): fds
  Please provide string value for 'location' (? for help): eastus2
  Deployment failed. Correlation ID: xxxx-x-x-x-x--x-xxxxxxx. {
    "error": {
      "code": "InvalidCreateRoleAssignmentRequest",
      "message": "The request to create role assignment 'xxxx--x-x-x--x-x-x-sxxssxxx' is not valid. Role assignment scope '/subscriptions/xxxxxxxx3-xxxxxxxd-xxxxxxxd-xxe-xxxxxxxx2/resourceGroups/myproject-devops/providers/Microsoft.Storage/storageAccounts/ertfds5h4nafspjqzii' must match the scope specified on the URI '/subscriptions/xxxxxxxx3-xxxxxxxd-xxxxxxxd-xxe-xxxxxxxx2/resourcegroups/myproject-devops'."
    }
  }
  </code></pre>
  
  <p>I tried to google, but getting different solutions. Where exactly i am missing. I tried to follow <a href="https://stackoverflow.com/questions/54939127/getting-issues-while-assigning-reader-role-to-storage-account-via-arm-template">this issue on stack-overflow</a></p>
  
  <p>Also, i am trying to assign permission to particular resource like:
  To assign to storage, below is code which is working fine:</p>
  
  <pre><code>{
        "type": "Microsoft.Storage/storageAccounts/providers/roleAssignments",
        "name": "[concat(variables('storageAccountName'),'/Microsoft.Authorization/',guid(subscription().subscriptionId))]",
        "apiVersion": "2019-04-01-preview",
        "dependsOn": [
          "[resourceId('Microsoft.Storage/storageAccounts/blobServices', variables('storageAccountName'), 'default')]",
          "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
        ],
        "properties": {
          "roleDefinitionId": "[concat(resourceGroup().id, '/providers/Microsoft.Authorization/roleDefinitions/17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
          "principalId": "[parameters('principalId')]",
          "scope": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
        }
      }
  </code></pre>
  
  <p>But same i need to do with cosmosDB, redis cache, key vault, but its not working, any idea where i am missing. Below are codes:</p>
  
  <p>For cosmosDB::</p>
  
  <pre><code>{
        "type": "Microsoft.DocumentDB/databaseAccounts/providers/roleAssignments",
        "name": "[concat(variables('cosmosDBAccountName'),'/Microsoft.Authorization/',guid(subscription().subscriptionId))]",
        "apiVersion": "2019-04-01-preview",
        "dependsOn": [
          "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', variables('cosmosDBAccountName'), parameters('Project'))]",
          "[resourceId('Microsoft.DocumentDB/databaseAccounts', variables('cosmosDBAccountName'))]"
        ],
        "properties": {
          "roleDefinitionId": "[concat(resourceGroup().id, '/providers/Microsoft.Authorization/roleDefinitions/5bd9cd88-fe45-4216-938b-f97437e15450')]",
          "principalId": "[parameters('principalId')]",
          "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', variables('cosmosDBAccountName'))]"
        }
      }
  </code></pre>
  
  <p>For Redis cache::</p>
  
  <pre><code>{
        "type": "Microsoft.Cache/Redis/providers/roleAssignments",
        "name": "[concat(variables('redisCacheName'),'/Microsoft.Authorization/',guid(subscription().subscriptionId))]",
        "apiVersion": "2019-04-01-preview",
        "dependsOn": [
          "[resourceId('Microsoft.Cache/Redis', variables('redisCacheName'))]"
        ],
        "properties": {
          "roleDefinitionId": "[concat(resourceGroup().id, '/providers/Microsoft.Authorization/roleDefinitions/e0f68234-74aa-48ed-b826-c38b57376e17')]",
          "principalId": "[parameters('principalId')]",
          "scope": "[resourceId('Microsoft.Cache/Redis', variables('redisCacheName'))]"
        }
      }
  </code></pre>
  
  <p>For Key vault:</p>
  
  <pre><code>{
        "type": "Microsoft.KeyVault/vaults/providers/roleAssignments",
        "name": "[concat(variables('keyVaultName'),'/Microsoft.Authorization/',guid(subscription().subscriptionId))]",
        "apiVersion": "2019-04-01-preview",
        "dependsOn": [
          "[resourceId('Microsoft.KeyVault/vaults', variables('keyVaultName'))]"
        ],
        "properties": {
          "roleDefinitionId": "[concat(resourceGroup().id, '/providers/Microsoft.Authorization/roleDefinitions/f25e0fa2-a7c8-4377-a976-54943a77a395')]",
          "principalId": "[parameters('principalId')]",
          "scope": "[resourceId('Microsoft.KeyVault/vaults', variables('keyVaultName'))]"
        }
      }
  </code></pre>