Update, it's not the batch account read, but the /listKeys operation for the account service.

The client 'ascobie@microsoft.com' with object id '09a78045-22ea-455c-96b0-35f8422a188e' does not have authorization to perform action 'microsoft.batch/batchaccounts/listKeys/action' over scope '/subscriptions/5a7274cb-7e6f-4158-960a-17a31acb807d/resourcegroups/default-azurebatch-eastus2/providers/microsoft.batch/batchaccounts/daryleus2'

public getAccountKeys(accountId: string): Observable {
const subId = ArmResourceUtils.getSubscriptionIdFromResourceId(accountId);
return this.subscriptionService.get(subId)
.flatMap((sub) => this.azure.post(sub, ${accountId}/listKeys))
.map(response => new AccountKeys(response.json()))
.share();
}

Guess we just trap and ignore this error?