IAM role assignment no users listed

Sam H 1 Reputation point
2022-11-16T22:28:19.35+00:00

I’m new to Azure, and am only trying to deploy AVD for personal use, but for some reason I am unable to assign roles to any user (member) in IAM.

For example, when trying to add the “Virtual Machine User Login” role to myself (directory Global Admin) at the Resource Group level, I just get the error message “an error occurred, please try again later” (see screenshot attached).

I’ve looked for support, but the only thing related seems to be about relaxing guest user permissions, which I’ve tried, but as expected didn’t fix my issue. Feel like I’m either missing something simple or something has gone wrong.

Any help would be much appreciated, thanks!

261118-00a0fb35-b2b7-4eeb-b45e-2a335e75bf17.jpeg

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
716 questions
Azure Virtual Desktop
Azure Virtual Desktop
A Microsoft desktop and app virtualization service that runs on Azure. Previously known as Windows Virtual Desktop.
1,448 questions
{count} votes

2 answers

Sort by: Most helpful
  1. Michael Durkan 12,196 Reputation points MVP
    2022-11-16T22:49:35.757+00:00

    Hi

    its strange that its not working as you are doing it at Resource Group level which is the recommended method. Can you try and create another user in your Azure AD to see if you can assign the role to them?

    Alternatively, have you tried assigning the IAM roles directly on the DAG object under "Application Groups"? Does this give the same error?

    261172-image.png

    261155-image.png

    If this still gives the same error, try creating a new Resource Group in a different Azure Region and see if you can do an IAM assignment directly on that new RG (without creating any resources)

    Hope this helps,

    Thanks

    Michael Durkan

    • If the reply was helpful please upvote and/or accept as answer as this helps others in the community with similar questions. Thanks!
    1 person found this answer helpful.

  2. JamesTran-MSFT 36,541 Reputation points Microsoft Employee
    2022-11-18T22:20:33.327+00:00

    @Sam H
    Thank you for following up on this and for providing more details on your issue!

    When it comes to adding a role assignment to a Resource Group or Resource within your Azure subscription, you'll be leveraging Azure role-based access control (Azure RBAC). For your specific situation, your user must have Microsoft.Authorization/roleAssignments/write permissions, such as User Access Administrator or Owner, in order to assign roles. When it comes to you being a Global Administrator, this is strictly related to Azure AD Roles. For more info - How the roles are related.

    In order to troubleshoot and resolve your issue, you'll have to check your IAM permissions, either at the Resource Group (AVD) or Resource (AVDPOOL-DAG or HawkAVD) level where you're trying to assign the Virtual Machine User Login role.

    • From your Resource Group or Resource, select Access Control (IAM).
    • Select the View my Access button or Role Assignments tab to view your user's permissions
    • Confirm you're either a User Access Administrator, Owner, or have a role with the /roleAssignments/write permissions permission.

    262064-image.png

    Additional Link:
    Assign Azure roles using the Azure portal

    • If you're still having issues, can you share a screenshot of your IAM permissions (Keeping in mind PII)?
    • Are you able to assign IAM permissions within different Resource Groups?
    • Do you own this Subscription or is this a shared subscription?

    If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

    ----------

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.