204051 - Failed to Create an NSG Rule

Uploading...Agent error code #204051 indicates that az network nsg rule create failed. This is the operation that grants a user access.

Common causes include:

The service principal can read the NSG but not modify it The NSG has reached its rule limit Another process changed the NSG at the same time, so the write conflicted The agent host could not reach the Azure management API for the duration of the call A resource lock or Azure Policy on the resource group blocks the change

Steps to Resolve

Confirm the Service Principal Can Write

Read access is not enough. The agent has to create and delete rules.

In the Azure portal, open the NSG > Access control (IAM) Confirm the app registration has Network Contributor, or an equivalent custom role including Microsoft.Network/networkSecurityGroups/securityRules/write Scope it to the NSG or its resource group

Check the Rule Count

Azure limits the number of rules per NSG.

Open the NSG > Inbound security rules and count them Knocknoc names the rules it owns with a kk- prefix, so stale entries are easy to spot Remove stale rules or request a quota increase

Look for a Lock or Policy

Open the resource group > Locks and check for a ReadOnly or Delete lock Check Policy for an assignment that denies changes to network security rules

Reproduce the Call by Hand

sudo -u knocknoc az network nsg rule create \
  --resource-group <resource-group> --nsg-name <nsg-name> \
  --name kk-test --priority 900 --access Allow --protocol Tcp \
  --destination-port-ranges <port> --source-address-prefixes 192.0.2.1/32

Remember to delete the test rule afterwards.