Publish fails on workspace products with the built-in administrators group #328

Command that triggered the bug

apiops publish

Expected behavior

apiops publish should handle a workspace product's service-scoped administrators group association without failing the publish or requiring permissions beyond the documented workspace collaborator roles.

The supported behavior should preserve the relevant source/target state. We have not verified whether APIM attaches this group to target workspace products automatically, so simply skipping the PUT may or may not preserve the association.

Actual behavior

Workspace products can have the built-in administrators group recorded in groups.json after apiops extract.

When publishing to a target workspace, the CLI attempts to PUT this ProductGroup link. With our publishing identity's permissions, this fails:

HTTP 403: LinkedAuthorizationFailed — client has 'groupLinks/write' on
workspaces/.../products/{product}/groupLinks/administrators but does not have
'Microsoft.ApiManagement/service/groups/write' on the linked scope .../groups/administrators

Microsoft recommends a service-scoped workspace companion role alongside the workspace role. However, neither API Management Service Workspace API Developer nor API Management Service Workspace API Product Manager grants Microsoft.ApiManagement/service/groups/write, the permission demanded by this error. This appears to require permissions beyond the documented workspace collaborator roles.

In our tests, this is a hard ERROR and causes exit code 1, even when every other resource publishes successfully. Extraction is unaffected.

The failure also occurs when republishing an existing product. v1.0.5's cleanupProductGroups() does not address that case because it only runs when !productExisted.

Our current workaround strips administrators entries from products/*/groups.json before publishing. This avoids the error, but we have not verified whether it preserves the association on the target.

apiops CLI version

1.0.5

Environment details

• Execution environment: Azure DevOps, Linux agent
• Node.js: v22.23.3
• Shell: Bash
• Azure CLI: 2.90.0
• Publish task: AzureCLI@2, task version 2.279.1
• Authentication: service principal
• APIM scope: workspace-scoped products
• Publish modes: reproduced with both incremental and full publishing

CI/CD environment

Azure DevOps

Is this bug blocking you?

None