I've created an ARM template that uploads an SSL certificate to Azure. I can run the ARM template from my local machine and it succeeds without any errors.
I then log into VSTS to set up a release template to perform the same task. I select the same template and provide the same parameters, but when I deploy the release it errors with a 401. The only information I can get by looking into the logs is that the request is denied because authorization failed.
I updated the permissions for the Service Principal account that VSTS is using to match my own (Owner, Contributor) of the resource group I'm deploying to and I get the same error. I then, temporarily, updated its permissions to Owner, Contributor of the entire subscription, and it still failed.
I'm beginning to suspect that this is an issue with Service Principal accounts in general, but I can't find any documentation to confirm or refute this claim.