---
title: "Can Role-Based Access Control (RBAC) Permissions Cause 403 Errors?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/could-role-based-access-control-rbac-permissions-cause-403-errors"
language: "en"
last_updated: "2026-10-07T19:02:10.853Z"
---

# Can Role-Based Access Control (RBAC) Permissions Cause 403 Errors?

Permissions are the primary cause of a 403 Forbidden error in the Spirion Sensitive Data Platform. In technical terms, a 403 status code means the server understood the request but is explicitly refusing to authorize it.

In Spirion Sensitive Data Platform, this permission failure typically occurs at 1 of 3 levels:

## 1\. Target Access Permissions (The most common cause)

This happens when the Spirion platform or Agent attempts to access a data source (like M365, a file share, or a database) but is blocked by the target system's security rules.

-   **OAuth/Token Scopes:** For cloud targets (OneDrive, SharePoint, etc.), the "Enterprise Application" may have been granted some permissions but lacks the specific "Scopes" required to read file content or enumerate certain sites.
-   **Service Account Restrictions:** For on-premises Targets, the service account used by the Agent may have "Read" access to a folder but is "Forbidden" from accessing specific sub-folders or files due to NTFS or share-level permissions.
-   **Conditional Access:** Security policies (like Azure AD Conditional Access) may block the request because it's coming from an unrecognized IP address or doesn't meet MFA requirements.

## 2\. Console User Permissions (RBAC)

This occurs when *you* (the console user) try to perform an action that your assigned role does not allow.

-   **Scoped Roles:** If your role is scoped to only manage agents with the tag `Location: London`, and you try to run a scan that includes agents tagged `Location: New York`, the console will return a 403 error.
-   **Action Restrictions:** You may have permission to *view* a scan definition but be "Forbidden" from *executing* it.

## 3\. Platform/Tenant Misalignment

-   **Tenant ID Mismatch:** If an agent is registered to one tenant but tries to ship results to another, the SaaS Ingress service will return a 403 Forbidden because that agent is not authorized to communicate with that specific tenant's data store.
-   **Invalid Registration:** If an agent's registration has been revoked or has expired, it is no longer "authorized" to receive work or ship results, leading to a 403.

## Summary: Why 403 is different from 401

-   **401 Unauthorized:** Means "I don't know who you are" (Bad password/Expired token).
-   **403 Forbidden:** Means "I know who you are, but you are **not allowed** to do this" (Insufficient permissions/Blocked by policy).

## Troubleshooting Tip

If you are getting a 403 on a cloud scan, the first step is almost always to **re-authenticate the Target** in the console to ensure the tokens and permissions (scopes) are up to date.