How to give permission inside of Management Group

Question

How to give permission inside of Management Group

Andrew Valle 60

The owner of the Azure enviroment can't give access to the main Management groups. When I go to management group it says "You are registered as a directory admin but do not have the necessary permissions to access the root management group.Click here for more info." I tried giving access through CLI and don't have the ability. There is no account higher then the one I'm using.

VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2025-10-16T23:21:43.5533333+00:00

Andrew Valle Just following up to check if you were able to elevate your access as a Global Administrator using the steps provided. Please let me know if you need any further assistance.
Andrew Valle 60 Reputation points

2025-10-20T17:48:09.3766667+00:00

Hey Luis,

Yes I see I now have root access. I will test linking Crowdstrike with Azure to see if we are all good now with no errors.
VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2025-10-21T20:09:30.0266667+00:00

Andrew Valle Thank you for your response, If your question has been solved, then you can click "Accept Answer", which may help members with similar questions find the answer easily. If you need further assistance, please let me know.

Answer accepted by question author

VEMULA SRISAI 13,890 Microsoft External Staff Moderator

Hello Andrew Valle,

Thank you for posting your question in the Microsoft Q&A Forum.

The message you’re seeing occurs because being a Global Administrator in Entra ID does not automatically grant RBAC permissions at the root management group (/). Even if you are the highest admin in the tenant, you still need explicit Owner or Management Group Contributor access at the root scope to view or manage management groups.

For that you need to elevate your access to all subscriptions and management groups.

Below are steps to elevate your access:

Step 1: Elevate access for a Global Administrator

Follow these steps to elevate access for a Global Administrator using the Azure portal.

Sign in to the Azure portal as a Global Administrator. If you are using Microsoft Entra Privileged Identity Management, activate your Global Administrator role assignment.
Browse to Microsoft Entra ID > Manage > Properties.

Select Properties for Microsoft Entra properties - screenshot

Under Access management for Azure resources, set the toggle to Yes.

Access management for Azure resources - screenshot

When you set the toggle to Yes, you are assigned the User Access Administrator role in Azure RBAC at root scope (/). This grants you permission to assign roles in all Azure subscriptions and management groups associated with this Microsoft Entra tenant. This toggle is only available to users who are assigned the Global Administrator role in Microsoft Entra ID.

Select Save to save your setting.

This setting is not a global property and applies only to the currently signed in user. You can't elevate access for all members of the Global Administrator role.

Sign out and sign back in to refresh your access.

You should now have access to all subscriptions and management groups in your tenant. When you view the Access control (IAM) page, you'll notice that you have been assigned the User Access Administrator role at root scope.

Subscription role assignments with root scope - screenshot

For your reference, please go through the below document:

https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs

Please let me know if you need any additional details or further assistance .

0 comments

1 additional answer

Your answer

VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2025-10-16T23:21:43.5533333+00:00

Andrew Valle Just following up to check if you were able to elevate your access as a Global Administrator using the steps provided. Please let me know if you need any further assistance.
Andrew Valle 60 Reputation points

2025-10-20T17:48:09.3766667+00:00

Hey Luis,

Yes I see I now have root access. I will test linking Crowdstrike with Azure to see if we are all good now with no errors.
VEMULA SRISAI 13,890 Reputation points Microsoft External Staff Moderator

2025-10-21T20:09:30.0266667+00:00

Andrew Valle Thank you for your response, If your question has been solved, then you can click "Accept Answer", which may help members with similar questions find the answer easily. If you need further assistance, please let me know.

Answer 1

Hello Andrew,

Welcome to Microsoft Q&A, If you're seeing “You are registered as a directory admin but do not have the necessary permissions to access the root management group,” it means your account lacks the Owner or Management Group Contributor role at the root level. Even if you're a global admin, Azure RBAC is separate from Azure AD roles. To fix this:

(Option 1) Ask someone with Owner access on the root management group to assign you the Management Group Contributor role.
(Option 2) Based on your message I will suggest to use Elevate access for Global Administrator

CLI won’t help unless your account already has the needed role.

References:

https://learn.microsoft.com/en-us/azure/governance/management-groups/manage

If the information helped address your question, please Accept the answer.

Luis