User reported an issue where the preflight validation failed because he is trying to provision to azure, but he doesn't have enough access for role assignment. Preflight validation API is not checking user's permission on specific resource group, so this will not serve for the needs where admin want to only grant specific access to a user on individual resource group.

Just expanding a little further here, my current understanding of the issue is that some users are relying the current provision behavior where in a partial success scenario, the resource group would be created but the provision would fail after the RG creation. This is when the user would ask the admin to grant permissions. The ARM deployment validate behavior is working as expected.

From a workflow perspective, this all makes sense but it does rely on observing a partial success behavior.

A resource-group scoped deployment would mimic this behavior and fit the use-case here. Unfortunately, as a template author, this may not make a lot of sense to make a deployment resource-group scoped based on some users.

Still don't understand the use case where opting out of pre-validation checks makes sense. A failure caught during pre-validation is better than having the system in a partial success state by opting out. This might put us into other unknown scenarios from which recovery and/or cleanup might become harder. Would still push for us not to provide options to opt out.

Still don't understand the use case where opting out of pre-validation checks makes sense. A failure caught during pre-validation is better than having the system in a partial success state by opting out. This might put us into other unknown scenarios from which recovery and/or cleanup might become harder. Would still push for us not to provide options to opt out.

As Wei mentioned, in this specific case, user is trying to use a subscription for which he is not the owner, and the preflight error message occurs as expected. Without preflight, same error message is displayed during provision. Then user asked the owner of the subscription to add the necessary permissions for the user for the specific resource group. Since user have no control of how template author makes the deployment, this will block the user of provision the templates.

IMO This may not create extra unknow scenarios for recovery or clean up case. Not sure if my explanation helps for the alignment. Let's discuss any concerns in parking lot.