Azure AD Add/Create User option is greyed out

Question

When logged into the Azure portal as the Azure Account Owner, I cannot create a new user in AD and unsure why. There is only one user currently in this account being myself, the one who registered the azure account originally i.e. the bill payer.

The Create button is also greyed out.

I hadnt changed any role assingments for my own account. I also dont have the option to add additional roles to my own account so unsure how I can elevate my own access as the account owner in order to give myself the privaledges to add additional users...

Answer 1

HI ,

This is clearly an Access issues , based on the screenshot , it is not clear what all other roles you have access to apart from Service Support Admin. Can you share that screenshot so that it can be validated. You can find that in the Assigned Roles Tab in your user section , like below.

Answer 2

@OJB1

Sorry for the inconvenience on this.

I would like to explain you couple of things in Azure.

There are multiple Azure roles. Few roles can be assigned on the Azure subscription/resource groups/resource levels. These are called as RBAC. As per your explanation and screenshot, you are the owner on the subscription. This means you will be able to do anything on the subscription level. That is you can create resources, assign roles for other users on subscription/resource group/resource level.

Keeping owner role does not allow complete access on the Azure active directory.

There are seperate set of roles which are part of Azure Active Directory.

https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

Above article talks about the built in roles in Azure Active Directory. Each role will have different permissions using which different tasks can be performed with Azure Active Directory.

By looking at screenshot that you shared, I see that you have Dynamics 365 admin, exchange admin, helpdesk admin, power BI admin, Service support admin, SharePoint admin and skype for business admin roles assigned.

None of the above role has permission to create new user's or assign roles to any other users within Azure active directory.

Since you mentioned that there is no other user in the Azure AD apart from you, then my question is who assigned these roles to your user account.

Ideally there should be some other user in your Azure AD who will be carrying global admin or user administrator role.

You can access Azure Active directory and click on Users blade on the left side.

See if you can see any other user accounts apart from your account.

If you are still unable to see any other user accounts, then you will have to contact data protection team.

You can reach out to the Azure Data Protection team to restore access. 866-807-5850

Also, for the future, you can create an emergency access account (break glass) in Azure AD. This account will help prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you can't sign in for any reason.

https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access

Some other support option include;

AzureSupport

https://support.microsoft.com/en-us/topic/global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

azcommunity@microsoft.com

or creating a ticket through a different account:  https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support?view=o365-worldwide#phone-support

Do let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.