Can Role Based Access Control (RBAC) Permissions Cause 403 Errors?

In Spirion Sensitive Data Platform, this permission failure typically occurs at 1 of 3 levels:

1. Target Access Permissions (The most common cause)

This happens when the Spirion platform or Agent attempts to access a data source (like M365, a file share, or a database) but is blocked by the target system's security rules.

• OAuth/Token Scopes: For cloud targets (OneDrive, SharePoint, etc.), the "Enterprise Application" may have been granted some permissions but lacks the specific "Scopes" required to read file content or enumerate certain sites.
• Service Account Restrictions: For on-premises Targets, the service account used by the Agent may have "Read" access to a folder but is "Forbidden" from accessing specific sub-folders or files due to NTFS or share-level permissions.
• Conditional Access: Security policies (like Azure AD Conditional Access) may block the request because it's coming from an unrecognized IP address or doesn't meet MFA requirements.

2. Console User Permissions (RBAC)

This occurs when you (the console user) try to perform an action that your assigned role does not allow.

• Scoped Roles: If your role is scoped to only manage agents with the tag Location: London, and you try to run a scan that includes agents tagged Location: New York, the console will return a 403 error.
• Action Restrictions: You may have permission to view a scan definition but be "Forbidden" from executing it.

3. Platform/Tenant Misalignment

• Tenant ID Mismatch: If an agent is registered to one tenant but tries to ship results to another, the SaaS Ingress service will return a 403 Forbidden because that agent is not authorized to communicate with that specific tenant's data store.
• Invalid Registration: If an agent's registration has been revoked or has expired, it is no longer "authorized" to receive work or ship results, leading to a 403.

Summary: Why 403 is different from 401

• 401 Unauthorized: Means "I don't know who you are" (Bad password/Expired token).
• 403 Forbidden: Means "I know who you are, but you are not allowed to do this" (Insufficient permissions/Blocked by policy).

Troubleshooting Tip

If you are getting a 403 on a cloud scan, the first step is almost always to re-authenticate the Target in the console to ensure the tokens and permissions (scopes) are up to date.