Receiving 'BadRequest' when assigning RBAC role to Azure Subscription for GDAP Partner (ForeignGroup) in Customers tenant

For what it's worth, we had the same issue with granting ourselves access to one of our customer's Azure subscriptions using the foreign security principal. Long and short of the fix is:

• Must have a Partner Relationship created. Create it by signing into Partner Center > New Customer > copy the link from the email tenant > sign into customer tenant as admin > paste the link and accept the relationship.
• Connect to customer tenant with PowerShell and grant the access:
  • Connect-AzAccount -TenantId xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
  • New-AzRoleAssignment -ObjectID "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -RoleDefinitionName "Owner" -Scope "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -ObjectType "ForeignGroup"
• In customer tenant, go to Entra ID > External Identities > Cross-tenant access settings > Org settings > choose inbound access of your partner organization > Trust Settings > choose 'customize' and select 'Trust Multifactor Auth' and 'Trust Compliant Devices'

This should allow the permission to be added and if you select the subscription in question in the customers tenant > Access Control > Role Assignments > you'll see the 'Foreign Principal for 'PartnerName'' listed.

@Anonymous Apologies for all the trouble you have to go through to fix this, I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue:

We are receiving the following error when attempting to connect a customer's subscription to our Partner Center GDAP CSP:

New-AzRoleAssignment : Operation returned an invalid status code 'BadRequest'

We are using the following command:

New-AzRoleAssignment -ObjectID "id of agentagents group in the partner tenant" -RoleDefinitionName "Support Request Contributor" -Scope "/subscriptions/customers subscription id" -ObjectType "ForeignGroup"

• This command is being run by a Global Admin in the customer tenant that has Owner on the subscription.
• This command was always successful previously prior to 6/1/2023. We have run it successfully in dozens of customer tenants when establishing GDAP relationships for customers with existing subscriptions.
• I can create a brand-new tenant with a brand-new subscription and successfully establish GDAP in the partner center, but still have this error once I try to add the RBAC to the subscription itself.
• The ObjectID and RoleDefinitionName are the same ones we have always used.
• Any tenants that we previously had existing RBAC roles on do not have this error. The command runs successfully even if we remove the existing RBAC role assignment and add it back.
• We have tried this from every browser known to man including the Cloud Shell from the Azure Portal.
• This is happening in multiple customer tenants for any new customer that didn't have a gdap relationship established prior to 6/1/2023.

Solution: Resolved by @Anonymous

Turns out the reseller agreement was not being set up properly when gdap was issued for the customers affected. Issue is resolved.