How to debug a ConflictError when adding an access policy to a key vault using an ARM deployment

Question

I am trying to add access policies to a Keyvault using ARM deployment. Multiple access policies are being deployed at the same time (using copy Arm method and nested templates), and some of them (not always the same ones when I retrigger the deployment) are failing with the following error:

{
  "error": {
    "code": "ConflictError",
    "message": "A conflict occurred to prevent the operation from completing."
  }
}

The error message is not really descriptive, is there any way to have more information about what went wrong?

Answer 1

I had the same error, I guess that it is because you are trying to modify the same item "key vault" in parallel. This change fixed my problem:

"mode": "serial"

"copy": {
    "name": "<name-of-loop>",
    "count": <number-of-iterations>,
    "mode": "serial" <or> "parallel"
}

Answer 2

You also get the error message (A conflict occurred to prevent the operation from completing) if you are trying to create a key, into a KeyVault that have a deleted key with the same name (KeyVault has soft-delete turned on).

Answer 3

During deployment, you can request that additional information is logged during a deployment. In powershell, set the DeploymentDebugLogLevel parameter to All.

New-AzResourceGroupDeployment `
  -Name exampledeployment `
  -ResourceGroupName examplegroup `
  -TemplateFile c:\Azure\Templates\storage.json `
  -DeploymentDebugLogLevel All

Then you can examine the request content or the response content.

(Get-AzResourceGroupDeploymentOperation `
-DeploymentName exampledeployment `
-ResourceGroupName examplegroup).Properties.response `
| ConvertTo-Json

For more details regarding troubleshoot deployment errors, you can refer to https://learn.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-common-deployment-errors