Question
While trying to update the credential asset in Orchestrator using the ‘Set Credential’ activity, you may encounter the following Forbidden (403) error.
Error Message:
Microsoft.Rest.HttpOperationException: Operation returned an invalid status code ‘Forbidden’
Answer
Cause
This occurs when you do not have view or edit permissions for the asset you are targeting in the activity.
Solution
Please try the following steps:
- Check the folder where the target asset is located
In Orchestrator, check the folder where the credential asset you want to update is located.
If the asset is in a different location than the folder where the process is executed, verify the permissions for both the execution location and the folder where the asset exists.
- Check the permissions of the execution account
Ensure that the account executing the job or the roles assigned to that account have the following permissions for the target folder:
Resource Required Permission Purpose
Asset View To reference the target asset
Asset Edit To update the value of the credential asset
In addition to having access to the folder, it is necessary that a role with permission to edit the asset is assigned.
- Grant permissions following the principle of least privilege
Accounts that can edit the credential asset have the ability to change the values of the credentials stored in the asset.
Therefore, please note the following points:
-
Grant permissions only to the necessary execution accounts.
-
Limit the scope of permissions to only the required target folders.
-
Avoid wide permissions that affect the entire organization or blanket changes to default roles.
-
Use custom roles with specific purposes where possible.
- Re-run the job
After granting or modifying the necessary permissions, re-run the process.
If the permissions are set correctly, the update of the credential asset using the ‘Set Credential’ activity will complete successfully.