When I make a deploy definition for a logic app, I have to add a task Azure ResourceGroup Deployment. In this task, you must select an Azure Subscription and then click Authorize. Authorize let’s you enter a username/password after which a service endpoint must be created. You need a service endpoint to connect your VSTS environment to your Microsoft Azure subscription. This is where it goes wrong. I receive underlying error:
This error typically occurs when you do not have Write permission for the selected Azure subscription when the system attempts to assign the Contributor role. To resolve this issue, there are multiple solutions.
The prefered solution is to open de drop-down list from the Authorize button and click Advanced. In the Advanced menu you select a resource group. Now a service endpoint is created. In the drop-down box to select a subscription, you can now select a service endpoint instead of an (unauthorized) subscription. This solves your issue.
Alternatively (not preferred), ask the subscription administrator to configure an Admin Access role for your identity.
• In the Azure Portal go to Azure Active Directory
• Select User
• Select Directory Role
• Select Global Administrator
Further reading: Microsoft.com