204050 - Failed to List NSG Rules

Agent error code #204050 indicates that Knocknoc could not read the rules on the network security group, or read them and could not parse the response. This read runs before any change is made to the NSG, so the grant stops here.

Common causes include:

• The NSG name or resource group on the knoc does not match an existing NSG
• The service principal lacks read permission on the NSG
• The wrong subscription is configured, so the NSG is not visible
• The agent host could not reach the Azure management API
• The call was cut short by a timeout

Steps to Resolve

Confirm the NSG Name and Resource Group

1. In the Azure portal, go to Network security groups
2. Open the NSG intended for use with Knocknoc
3. Confirm its name and resource group match the knoc configuration exactly. Both are case-sensitive in the CLI

Reproduce the Call by Hand

From the agent host:

sudo -u knocknoc az network nsg rule list \
  --resource-group <resource-group> --nsg-name <nsg-name> -o json

The error this returns is the one the agent received.

Confirm the Role Assignment

The service principal needs at least reader access on the NSG, and contributor-level access to change it. Network Contributor scoped to the NSG or its resource group covers both.

1. In the Azure portal, open the NSG > Access control (IAM)
2. Confirm the app registration appears under Role assignments

Why This Is Worth Fixing Promptly

While this read is failing, expired rules are not removed from the NSG. Access that should have lapsed stays open until the read succeeds again, so treat a persistent failure here as urgent rather than cosmetic.