Authorization error from deploying management group to tenant using az cli with owner/contributor role.

Question

Below is the error I got trying to deploy new management group.

I have contributor role on my service principle.

{"code": "AuthorizationFailed", "message": "The client '' with object id '' does not have authorization to perform action 'Microsoft.Management/managementGroups/Microsoft.Management/UAT/Microsoft.Resources/testuat/action' over scope '/providers/Microsoft.Management/managementGroups/providers/Microsoft.Management/managementGroups/UAT/providers/Microsoft.Resources/deployments/testuat/validate' or the scope is invalid. If access was recently granted, please refresh your credentials."}

Answer 1

Hi Ajayi,

To create deployment at any scope, you would need permissions to create and manage deployment at that scope. So, if you are deploying at the tenant level, you need deployment permissions at tenant scope. Contributor has that permission.

As you are creating MG at tenant scope, contributor role would need be enough at tenant scope. You need https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#management-group-contributor role.