”az webapp deploy“ requires additional "Microsoft.Web/Serverfarms/read" permission since version 2.59.0, which is unexpected

[kevin808]

Describe the bug

It is not expected for the app service deployment to require additional permission for "Microsoft.Web/Serverfarms/read".

When run the same command prior to version 2.59.0, there is no issues.

Related command

az webapp deploy --resource-group APP --name xxx --src-path .\package.zip --type zip --async true

Errors

The client 'xxx' with object id 'xxx' does not have authorization to perform action 'Microsoft.Web/serverfarms/read' over scope '/subscriptions/xxx/resourceGroups/APP/providers/Microsoft.Web/serverfarms/LinuxPlan' or the scope is invalid. If access was recently granted, please refresh your credentials.
Code: AuthorizationFailed

Issue script & Debug output

N/A

Expected behavior

The deployment should go without issues

Environment Summary

PS D:\demo\sql-nodejs> az --version
azure-cli 2.60.0

core 2.60.0
telemetry 1.1.0

Extensions:
serviceconnector-passwordless 1.0.2
spring 1.20.1

Dependencies:
msal 1.28.0
azure-mgmt-resource 23.1.0b2

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\lkevi.azure\cliextensions'

Python (Windows) 3.11.8 (tags/v3.11.8:db85d51, Feb 6 2024, 21:52:07) [MSC v.1937 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @AzureAppServiceCLI, @antcp.