I am running a site on Acquia's dev cloud, using Acquia's Dev Desktop and sometime in the last few months something has changed to prevent access to the Update tab inside admin/modules/update. I'm logged in as the drupal admin, but when i try to access that page i get:

You are not authorized to access this page.

Also on that page, cron had stopped running regularly. When I tried running manually, it would give me the same error

4 Answers 4


This is the code for access to 'admin/modules/update', in 'update_manager_access':

  return variable_get('allow_authorize_operations', TRUE) && user_access('administer software updates');

So there are 2 reasons you wouldn't be able to access this page:

  1. You don't have the administer software updates permission
  2. The allow_authorize_operations variable is set to FALSE

The second is probably your problem. This is a "global killswitch in settings.php" - the admin/modules/update path allows people to pull and upgrade modules without having actual server access, and Acquia may have disabled that for security.

For those experiencing this and not hosted on Acquia, some of my sites were returning NULL for allow_authorize_operations even though it's FALSE in settings.php. Rebuilding permissions did not resolve this so I used variable_set in a PHP global field in a view.


  • The question is about Drupal 8, your answer applies only to Drupal 7.
    – mvdgun
    Jun 29, 2017 at 18:34

What worked for me was rebuilding permissions under "/admin/reports/status/rebuild" (Make sure to take a db backup).

Right after rebuilding, I saw all the available updates.

Thought this might be of help to someone.


In my case (for Drupal 8 / 9 in contrast to the other anwser) the reason was

$settings['allow_authorize_operations'] = FALSE;

was set in settings.php. The current Drupal default is TRUE.

Down the path this leads to access denied for all paths from update.routing.yml with these requirements:

    _permission: 'administer software updates'
    _access_update_manager: 'TRUE'

Drupal simply returns Access Denied even for admins, but doesn't explain the reason.

See https://www.drupal.org/project/drupal/issues/2055185#comment-14240814 for details and help to improve the situation.

So you should check if $settings['allow_authorize_operations'] = TRUE; could be appropriate for you or if it's disabled for security reasons.



In Drupal 9.3.5 this message was found in the dblog:

Path: /admin/reports/updates/check. 
'csrf_token' URL query argument is missing. 
in Drupal\Core\Routing\AccessAwareRouter->checkAccess() 
(line 118 of 


Fixed with clearing/rebuilding caches with drush:

drush cr

This was on a local Ubuntu development machine.

Trigger - maybe

I remember visiting some page that did not work with a token in the URL parameter. I removed the token and tried again. After that, the access was denied to the Updates page, as an administrator.

I also ran some cli commands to tighten up file permissions prior to this happening.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.