Unable to add new Microsoft Entra admin

Question

Unable to add new Microsoft Entra admin

Tim Miller 0

Hi,

We have a flexible server that I am trying to add some new accounts in. To do this I need to be a Microsoft Entra admin. However, whenever I try to add myself as an admin I get this error:

{

  "status": "Failed",

  "error": {
"code": "ResourceDeploymentFailure",

"message": "The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.",

"details": [

  {

    "code": "AadAuthPrincipalCreationFailed",

    "message": "Failed to create Azure AD Principal. Reason - Updating existing principal is not supported yet. Please drop the given principal first."

  }

]
}

}

We do however have a dev instance, and I was able to add myself as an admin on that one. Could someone please explain:

Why I was able to add myself as a Microsoft Entra admin in one instance, but not the other?
How can I add myself as a Microsoft Entra admin in our prod instance?

Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-04T08:58:04.0533333+00:00
Hi Tim Miller,

Greetings!

You are facing an issue with adding yourself as a Microsoft Entra admin due to an existing principal that needs to be dropped first. Here are some steps to help you resolve this:

Why you Were Able to Add Yourself in the Dev Instance but Not in Prod

Existing Principal

The error message indicates that there is an existing Azure AD principal that needs to be dropped before you can add a new one. This might not have been the case in your dev instance, allowing you to add yourself without issues.

Configuration Differences

There might be differences in the configuration or state of the dev and prod instances. For example, the dev instance might not have had an existing principal, or it might have been set up differently.

How to Add Yourself as a Microsoft Entra Admin in the Prod Instance

Remove Existing Principal

You need to remove the existing Azure AD principal before adding yourself as an admin. You can do this using PowerShell.

Remove-AzSqlServerActiveDirectoryAdministrator -ResourceGroupName <resource-group-name> -ServerName <server-name>

Add Yourself as Admin

After removing the existing principal, you can add yourself as the Microsoft Entra admin.

New-AzSqlServerActiveDirectoryAdministrator -ResourceGroupName <resource-group-name> -ServerName <server-name> -DisplayName <your-display-name> -ObjectId <your-object-id>

Ensure that your production instance has the necessary permissions and policies configured to allow the creation of new Azure AD Principals. You might need to check with your Azure AD administrator to verify these settings.
I hope this information helps. Please do let us know if you have any further queries.
Tim Miller 0 Reputation points

2025-04-07T01:24:45.7333333+00:00
It appears that you gave me commands to work with an SQL Server instance. However, I am working with Azure Database for PostgreSQL flexible server. After a bit of googling I did manage to find the equivalent commands, but I'm still running into issues with that. This is the command I have to remove the current admin:

az postgres flexible-server ad-admin delete --resource-group <resource-group> --server-name <server-name> --object-id <object-id>

And this is the error it produces:

(InvalidResourceIdSegment) The 'objectId' segment in the url is invalid. Code: InvalidResourceIdSegment Message: The 'objectId' segment in the url is invalid. Exception Details: (InvalidResourceIdSegment) The value '<redacted>' is not valid for Guid. Code: InvalidResourceIdSegment Message: The value '<redacted>' is not valid for Guid. Target: objectId

I have confirmed that the object id is correct. The only thing I can think of that my be causing this is that the Entra admin for the database is a group rather than an individual account. Any thoughts on this?
Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-07T06:27:03.4666667+00:00
Hi Tim Miller,

Thanks for the follow-up. the commands I initially provided were SQL Server-specific. Great to hear you found the PostgreSQL equivalents. Now, let’s troubleshoot the error you're getting when trying to remove the existing Azure AD admin.

Despite passing what appears to be a valid object ID, this usually happens due to one of the following reasons:

1.Missing or Empty --object-id Argument:

The CLI expects a valid GUID for --object-id. If this value is empty (even a space or null), it throws this error. Double-check that you're correctly supplying the object ID value:

az postgres flexible-server ad-admin delete \ --resource-group <resource-group-name> \ --server-name <server-name> \ --object-id <object-id> # <- Ensure this is a GUID, no quotes if using variables

2.Admin is a Group (Not a User)

if the current admin is a Microsoft Entra Group, the CLI sometimes struggles to resolve and delete it directly via --object-id. This is a known limitation when working with group principals.Please try the below steps

Option 1: Use Display Name Instead

Try deleting using the --display-name parameter instead:

az postgres flexible-server ad-admin delete \ --resource-group <resource-group-name> \ --server-name <server-name> \ --display-name "<group-display-name>"

Note: The display name must match exactly what's shown in the Azure portal under “Active Directory Admin” for the PostgreSQL server.

Option 2: Use Azure Portal

If the CLI continues to fail, you can manually remove the AD admin through the Azure Portal:

Navigate to your PostgreSQL flexible server.

Go to Active Directory Admin.

Click Remove Admin (or change to a different one)

Make sure the identity you're logged in as (with az login) has Contributor or higher role on the PostgreSQL server and permissions in Entra ID to manage directory objects.

After removal, you can add yourself using:

az postgres flexible-server ad-admin create \ --resource-group <resource-group-name> \ --server-name <server-name> \ --display-name "<your-name>" \ --object-id <your-object-id>

I would request you to refer the below mentioned link for more information
https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-manage-azure-ad-users

I hope this information helps. Please do let us know if you have any further queries.
Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-08T09:02:51.1233333+00:00

Hi Tim Miller,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-09T04:11:25.34+00:00

Hi Tim Miller,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Tim Miller 0 Reputation points

2025-04-09T23:48:40.7133333+00:00

Hi Prasad Chaganti, our team has decided to take a different approach to this issue so I no longer need to configure the Microsoft Entra administrator for our database. Thanks for your help
Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-10T01:45:59.1933333+00:00

Hi Tim Miller,

I'm glad to hear you were able to make progress! could you kindly share the solution or steps that worked for you? could be helpful to other community members who might run into the same issue.
Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-11T00:43:53.7633333+00:00

Hi Tim Miller,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet.

In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Your answer

Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-04T08:58:04.0533333+00:00

Hi Tim Miller,

Greetings!

You are facing an issue with adding yourself as a Microsoft Entra admin due to an existing principal that needs to be dropped first. Here are some steps to help you resolve this:

Why you Were Able to Add Yourself in the Dev Instance but Not in Prod

Existing Principal

The error message indicates that there is an existing Azure AD principal that needs to be dropped before you can add a new one. This might not have been the case in your dev instance, allowing you to add yourself without issues.

Configuration Differences

There might be differences in the configuration or state of the dev and prod instances. For example, the dev instance might not have had an existing principal, or it might have been set up differently.

How to Add Yourself as a Microsoft Entra Admin in the Prod Instance

Remove Existing Principal

You need to remove the existing Azure AD principal before adding yourself as an admin. You can do this using PowerShell.

Remove-AzSqlServerActiveDirectoryAdministrator -ResourceGroupName <resource-group-name> -ServerName <server-name>

Add Yourself as Admin

After removing the existing principal, you can add yourself as the Microsoft Entra admin.

New-AzSqlServerActiveDirectoryAdministrator -ResourceGroupName <resource-group-name> -ServerName <server-name> -DisplayName <your-display-name> -ObjectId <your-object-id>

Ensure that your production instance has the necessary permissions and policies configured to allow the creation of new Azure AD Principals. You might need to check with your Azure AD administrator to verify these settings.
I hope this information helps. Please do let us know if you have any further queries.
Tim Miller 0 Reputation points

2025-04-07T01:24:45.7333333+00:00

It appears that you gave me commands to work with an SQL Server instance. However, I am working with Azure Database for PostgreSQL flexible server. After a bit of googling I did manage to find the equivalent commands, but I'm still running into issues with that. This is the command I have to remove the current admin:

az postgres flexible-server ad-admin delete --resource-group <resource-group> --server-name <server-name> --object-id <object-id>

And this is the error it produces:

(InvalidResourceIdSegment) The 'objectId' segment in the url is invalid. Code: InvalidResourceIdSegment Message: The 'objectId' segment in the url is invalid. Exception Details: (InvalidResourceIdSegment) The value '<redacted>' is not valid for Guid. Code: InvalidResourceIdSegment Message: The value '<redacted>' is not valid for Guid. Target: objectId

I have confirmed that the object id is correct. The only thing I can think of that my be causing this is that the Entra admin for the database is a group rather than an individual account. Any thoughts on this?
Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-08T09:02:51.1233333+00:00

Hi Tim Miller,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-09T04:11:25.34+00:00

Hi Tim Miller,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Tim Miller 0 Reputation points

2025-04-09T23:48:40.7133333+00:00

Hi Prasad Chaganti, our team has decided to take a different approach to this issue so I no longer need to configure the Microsoft Entra administrator for our database. Thanks for your help
Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-10T01:45:59.1933333+00:00

Hi Tim Miller,

I'm glad to hear you were able to make progress! could you kindly share the solution or steps that worked for you? could be helpful to other community members who might run into the same issue.
Prasad Chaganti 785 Reputation points Microsoft External Staff Moderator

2025-04-11T00:43:53.7633333+00:00

Hi Tim Miller,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet.

In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.