access denied in azure after to converting to Azure role-based access control (RBAC)

Question

access denied in azure after to converting to Azure role-based access control (RBAC)

Frank-Azure 25

Hello everyone,

I am writing to you because a few days ago I received the email with the following subject:

"Convert to Azure role-based access control (RBAC) "

"Azure classic administrator roles were retired on 31 August 2024 and are no longer supported. If you still have active Co-Administrator or Service Administrator role assignments, convert these roles to Azure RBAC immediately."

I followed the procedure indicated, simply locate my account in IAM, verify that it was "Service Administrator" and click on the "Assign RBAC role" button making sure that I maintained the "owner" role

The conversion was successful but now I am no longer authorized to consult the resources created (I had an AKS) and I cannot create other objects because I always receive the message "unauthorized user".

Can you help me?

Thanks

Vinodh247 32,191 Reputation points MVP

2025-03-28T14:26:09.1433333+00:00
Hi ,

Thanks for reaching out to Microsoft Q&A.

It sounds like the conversion from classic to RBAC left your account without the proper permissions at the subscription (or resource group) level. Even though you assigned yourself the “Owner” role, that role may not actually be inherited across every resource unless it is assigned at the correct scope (for example, the entire subscription).

Most of the time, the issue is simply that the “Owner” role you assigned was done at too narrow scope (resource group level only?), or that you’re logged in under the wrong directory. Double-check your assignment at the subscription scope, confirm that you’re in the right tenant, and you should be able to regain the ability to see and manage all your resources.

Few pointers to narrow down the issue:

Confirm you have a valid Owner assignment at the subscription scope

Go to the Azure Portal -> Subscriptions -> select your subscription -> Access control (IAM) -> View my access.

You should see an “Owner” (or at least “Contributor”) RBAC role at the subscription scope. If you only see it at the resource group (RG) level or for individual resources, you might still be denied access for other parts of the subscription.

Check whether you are in the correct AAD tenant Sometimes, if you have multiple tenants/directories, you might be in the wrong tenant in the portal. Ensure you’re in the right tenant by clicking your profile in the top-right corner of the portal and selecting the correct directory. If the subscription now resides in a different tenant, you won’t see the resources unless your Azure AD account has the right roles in that tenant. Validate there’s no conflicting role assignment or deny assignment
In some rare cases, a deny assignment or conditional access policy can override your “Owner” role, even if it’s assigned at the subscription level. Check the subscription’s role assignments (under Access Control (IAM) -> Role Assignments) to see if you have multiple, overlapping assignments and ensure no deny or custom roles conflict. Try reassigning yourself as “Owner” From the subscription’s Access control (IAM) -> Add role assignment, pick “Owner” -> search for your user principal name (UPN/email) -> assign. Wait a minute or two for Azure to propagate the permissions, then refresh your portal session or log out and log back in. After reassigning, go to Access control (IAM) -> View my access to confirm you appear as an Owner at the subscription scope. If still locked out, open a support request or have another Owner fix your roles If there’s another user who does have Owner permissions at the subscription level, ask them to confirm your assignment and reassign if necessary. If nobody has access, you may need to open a support request with Microsoft to help recover access.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.
Frank-Azure 25 Reputation points

2025-03-28T15:08:49.1133333+00:00

Now it works because I found an "activate" entry but the maximum time is 8 hours

In fact now I see all my objects, but after eight hours?

Is it normal?
Frank-Azure 25 Reputation points

2025-03-28T15:20:22.07+00:00

I found out that 8 hours is the maximum for "eligible" but I would like it as it was before, that is, the possibility of always being an owner, and therefore I expect there to be something in the "Active permanent assignments (0)" field.

How can I do it?
Frank-Azure 25 Reputation points

2025-03-31T08:44:30.0266667+00:00

thanks a lot, I resolved my issue

grazie
SrideviM 2,215 Reputation points Microsoft External Staff

2025-03-31T08:47:41.5166667+00:00

Hello Frank-Azure,

Glad to know that your issue is resolved!

Accepted answer

0 additional answers

Your answer

Frank-Azure 25 Reputation points

2025-03-28T15:08:49.1133333+00:00

Now it works because I found an "activate" entry but the maximum time is 8 hours

In fact now I see all my objects, but after eight hours?

Is it normal?
Frank-Azure 25 Reputation points

2025-03-28T15:20:22.07+00:00

I found out that 8 hours is the maximum for "eligible" but I would like it as it was before, that is, the possibility of always being an owner, and therefore I expect there to be something in the "Active permanent assignments (0)" field.

How can I do it?
Frank-Azure 25 Reputation points

2025-03-31T08:44:30.0266667+00:00

thanks a lot, I resolved my issue

grazie
SrideviM 2,215 Reputation points Microsoft External Staff

2025-03-31T08:47:41.5166667+00:00

Hello Frank-Azure,

Glad to know that your issue is resolved!

Answer 1

Hello Frank-Azure,

I understand your concern. It’s frustrating to lose access after making changes, especially when everything was working fine before.

This is happening because your Owner role was assigned as Eligible, meaning you have to activate it manually each time. Since activation lasts up to 8 hours, you lose access once it expires.

Eligible Role Assignment:

enter image description here

With this setting, Azure treats your role as temporary access, requiring you to turn it on whenever you need it.

To avoid this, the role should be set to Active instead. This ensures your access remains permanent without needing activation.

Permanent Active Role Assignment:

enter image description here

Once set up this way, your access will work as before, without interruptions.

Hope this helps! Let me know if you need any further assistance.

If this answer was helpful, please click "Accept the answer" and mark Yes, as this can help other community members.

User's image

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.

Share via

access denied in azure after to converting to Azure role-based access control (RBAC)

0 additional answers

Your answer