CODEWITHSUNDEEP
azureazure-cliazure-resource-group
JohnStephen.19
JohnStephen.19

Reputation: 363

Azure Owner Role cannot create Resource Group

I am assigned an owner role in my Employer's Azure subscription. He was able to create resource groups, but I can't. We're both wondering why since I was already assigned as Owner, the highest role aside from subscription level.

When I try the az group create --name myGroup -l southeastasia command, its response is

The client 'live.com#<myAccount>@outlook.com' with object id '<object ID>'
does not have authorization to perform action 'Microsoft.Resources/subscriptions/
resourcegroups/write' over scope '/subscriptions/<subscription>/resourcegroups/<myGroup>'.

Edit: I have no subscription level resources Azure Resources

Upvotes: 2

Views: 9389

Answers (3)

Shui shengbao
Shui shengbao

Reputation: 19195

Do you have multiple subscriptions in your tenant? If yes, you should set it.

##list subscription
az account list --output table

##change the active subscription
az account set --subscription "My Demos"

If you only have a subscription, I suggest you could create a sp, then use the sp to create a new resource group. See this link.

Update:

You should give Owner role on subscription level, according to your screenshot, you give Owner role on resource group role, you only create resources in the resource group. You also could not create new resource group. You should give Owner role to your subscription,like below:

enter image description here

Upvotes: 3

CHEEKATLAPRADEEP
CHEEKATLAPRADEEP

Reputation: 12768

Note: This issue is more likely to happen in newer subscriptions and usually happens if a certain resource type has never been created before in that subscription.

Subscription admins often fix this issue by granting resource group owners contributor rights on the subscription level which contradicts with their strategy of isolating access down to the level of resource group level not the subscription level.

For root cause and quick resolution, refer "Common problem when using Azure resource groups & RBAC".

Upvotes: 1

4c74356b41
4c74356b41

Reputation: 72171

Well, the error clearly says you dont have rights over the scope, so you are either owner of the wrong sub or you have a role that specifically restricts that.

Upvotes: 0

Related Questions