Overwrite hosted feature service failing in AGE 10.8.1

[Joshua-Young]

ArcGIS Enterprise 10.8.1 is no longer allowing hosted feature services to be overwritten by the account that published the service. There are no views associated with the services. I first encountered this issue when I updated a machine to use ArcGIS Pro 2.7. I have since uninstalled ArcGIS Pro and reinstalled ArcGIS Pro 2.6 with Patch 3. I published a new hosted feature service and tried to delete it through ArcGIS Portal and now that fails as well. I have to sign into ArcGIS Portal as an administrator to delete any hosted feature services, but even as the administrator I cannot overwrite an existing hosted feature service.

This is the error that shows up in the logs:

ERROR: code:403, You do not have permissions to access the API /services/Hosted/<service_name>/delete., Access to this resource is forbidden, regardless of authorization.

The only other thing I can think changed around the time this stopped working was installing the Portal for ArcGIS 10.8.1 Enterprise Sites Patch 2. 

[Joshua-Young · Accepted solution]

I found the problem and a solution for my environment.

The short answer: If you are using a custom role and you can no longer delete hosted feature services, try recreating the custom role and reassign users to the new custom role as needed.

The long answer:

1. I created a new user account as a Creator using the same custom role as the initial user account. I was able to duplicate the failure to overwrite or delete hosted feature services the new user was publishing.
2. I change the role of the new user to the default Publisher role and that fixed the problem. The new user was able to overwrite and delete hosted feature services that it published.
3. Changed it back to the custom role and it broke again.
4. Created a new custom role that was setup just like the old one and the new custom role is working as well. The only difference between the default Publisher role and my custom role is the ability to publish web tools. I do not know if it made a difference, but this time I used hyphens instead of spaces in the custom role name.
5. Assigned the user account that was initially experiencing the issue to the new custom role and the issue has been fixed.

I am still not sure what caused the initial custom role to stop working correctly. I have not modified that role since August.