How can I obtain access to a subscription when I don't know how to access the Azure RBAC owner

Julia Koelsch 0

I'm trying to modify or cancel a subscription that we are paying for, but I can't: the error message I see is "Although you have access to manage billing for this subscription, you don't have Azure RBAC access. The access is required to manage resources, cancel and re-enable a subscription. Contact an existing Azure RBAC owner of this subscription to get access. For more information, see the below link:" I don't know who the Azure RBAC owner is, or how to contact this person. What can I do? Thanks for any assistance

Dillon Silzer 57,231 Reputation points

2024-02-24T00:20:22.4633333+00:00

Do you have Global Administrator in the tenant?
SadiqhAhmed-MSFT 44,336 Reputation points Microsoft Employee

2024-02-29T06:52:31.4033333+00:00

@Julia Koelsch One more possibility is that, you may be the Global admin but not the subscription owner. Because you have been granted access to external directory where you will be able to access the directory but not the subscription. If this is not the case, you may reach out to Azure subscription management support by creating a support request. The ticket enables you to work closely with the support engineers and get a quick resolution to your issue. Here is the link - https://docs.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request to create support case. FYI: Azure Billing and Subscription Management support is included in the Basic Support Plan without any charge. https://azure.microsoft.com/en-us/support/plans/

2 answers

Marcin Policht 21,600 Reputation points MVP

2024-02-24T12:33:53.38+00:00

If you are a Global Administrator in the Microsoft Entra tenant associated with the Azure subscription, you can gain the owner privileges at the subscription level by following the procedure described in the following article: https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal

hth Marcin
Please sign in to rate this answer.

1 person found this answer helpful.
Julia Koelsch 0 Reputation points

2024-02-26T22:33:47.2433333+00:00

Thanks for the instructions. We have this enabled. I also made sure to log out/back in. However, I still see this message, and still cannot modify or cancel this subscription. I can't even detatch the card.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Michael Morten Sonne 585 Reputation points MVP

2024-02-24T17:05:27.3933333+00:00

I agree here with Dillon and Marcin - if you are or know a Global Administrator in the tenant, it will be possibel for you :)
Please sign in to rate this answer.
Julia Koelsch 0 Reputation points

2024-02-26T22:35:13.14+00:00

And if I'm not a Global Administrator, and I don't know who is, what should I do next?

Michael Morten Sonne 585 Reputation points MVP

2024-02-27T07:09:48.9466667+00:00

You can if the access to the Entra ID Portal is not blocked in your tenant, see in the Entra ID Portal how is role members: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles - search for the Global Administrator and click on that to see members. Let me hear if that give some hints.

Julia Koelsch 0 Reputation points

2024-02-27T15:17:02.09+00:00

Michael, my account is listed under Global Administrator assignments. Type = "User", Scope = "Directory"

Michael Morten Sonne 585 Reputation points MVP

2024-02-27T15:32:23.3433333+00:00

Hmm that is strange so if https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView > Properties > xxx (xxx) can manage access to all Azure subscriptions and management groups in this tenant is set.. We can try another thing: If you know the Subscription ID for the effected subscription you can try to access it via this link (replace to real data): https://portal.azure.com/#@<primary tenant domain>/resource/subscriptions/xxxxxxx-xxxxxxxxxx/users Here you can check your access and add any if needed. Let me hear from you id this can trick or not.

Michael Morten Sonne 585 Reputation points MVP

2024-02-27T16:03:01.6866667+00:00

Hmm that is strange so if https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView > Properties > xxx (xxx) can manage access to all Azure subscriptions and management groups in this tenant is set.. We can try another thing: If you know the Subscription ID for the effected subscription you can try to access it via this link (replace to real data): https://portal.azure.com/#@<primary tenant domain>/resource/subscriptions/xxxxxxx-xxxxxxxxxx/users Here you can check your access and add any if needed. Let me hear from you id this can trick or not.

Julia Koelsch 0 Reputation points

2024-02-27T21:54:52.2+00:00

Yes, just to confirm: I double-checked the settings and confirmed that the account has the checkbox on to manage access to all Azure subscriptions.

I also found the domain on the "Basic information" page within the Entra admin center, and subscription ID on the "Azure Subscriptions" page in the Cost Management section, and went to the link you suggested, and it says "No Access"

Session xxxxx

Resource ID/subscriptions/xxxxx

ExtensionHubsExtension

ContentResourceMenuBlade

Error code401

DetailsYou do not have authorization to access this resource.

Resource ID: /subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx

Status Code: 401

Status Message: unavailable

I guess I can stop payment through the credit card tied to the subscription, unless you have any other suggestions. It just seems really odd to me that I can't control something that we are quite obviously paying for. And the "support" option from the Cost Management section doesn't allow me to contact support, it is just a circular exercise in frustration.

I really appreciate your help! It's nice that there are folks like you are willing to offer help, even if I can't find a way through to actual product support.

Julia Koelsch 0 Reputation points

2024-02-28T00:01:03.8266667+00:00

Here is a screenshot to confirm access:

I found the primary tenant domain under the "Basic information" tab of the screenshot page, and the subscription ID when viewing the subscription under cost management -> Azure subscriptions (https://portal.azure.com/#view/Microsoft_Azure_CostManagement/Menu/~/subscriptions). The screen says the following (removing subscription ID):

No access

Summary

Session xxxxxxxxxxxxxxxxxxxxxx

Resource ID/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx

ExtensionHubsExtension

ContentResourceMenuBlade

Error code401

DetailsYou do not have authorization to access this resource.

Resource ID: /subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx

Status Code: 401

Status Message: unavailable

Anything else I can check? Thanks for your help!

Julia Koelsch 0 Reputation points

2024-02-28T00:02:42.1466667+00:00

Sorry for the double-post. I thought the first copy of this response didn't save successfully -- it wasn't visible to me until I posted the second

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Michael Morten Sonne 585 Reputation points MVP

2024-02-28T11:02:18.3833333+00:00

Same - can´t me my post..

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Michael Morten Sonne 585 Reputation points MVP

2024-02-28T11:06:58.36+00:00

I double-post also sometimes.. Regarding your update here, it´s strange - as the subscription is in your tenant and so, but you not have the access even if Global Admin and the setting in Entra ID is set to get the role to manage access to it... We can try one more thing: In the Azure Portal, try to go the Management Groups menu (https://portal.azure.com/#view/Microsoft_Azure_Resources/ManagementGroupBrowseBlade/~/MGBrowse_overview) - can you see the Azure Subscription here? Regarding the link to Azure Support, it is here if you need it: https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade/~/overview Im happy to help :)

Michael Morten Sonne 585 Reputation points MVP

2024-02-28T11:07:46.6166667+00:00

it´s strange - as the subscription is in your tenant and so, but you not have the access even if Global Admin and the setting in Entra ID is set to get the role to manage access to it... We can try one more thing: In the Azure Portal, try to go the Management Groups menu (https://portal.azure.com/#view/Microsoft_Azure_Resources/ManagementGroupBrowseBlade/~/MGBrowse_overview) - can you see the Azure Subscription here? Regarding the link to Azure Support, it is here if you need it: https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade/~/overview

Michael Morten Sonne 585 Reputation points MVP

2024-02-28T11:08:16.2266667+00:00

Oh man...

Michael Morten Sonne 585 Reputation points MVP

2024-03-03T20:52:23.54+00:00

Hi Julia,

Let me hear if you had a chance to test it or not :)

//Michael
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How can I obtain access to a subscription when I don't know how to access the Azure RBAC owner

2 answers

Your answer