"Insufficient privileges" error when creating service principal with az ad sp create-for-rbac

Question

I'm trying to create a service principal for Kubernetes CSI driver integration but encountering a permissions error:

Command executed:

az ad sp create-for-rbac --name "k3s-csi-driver" --role Contributor --scope /subscriptions/{subid}/resourceGroups/{resource} --output json

Error received:

"Insufficient privileges to complete the operation."

Additional details:

• I'm trying to set up a CSI driver for k3s Kubernetes cluster
• I need to create this service principal to allow my cluster to access Azure storage
• I verified I have owner and contributor roles

What specific permissions do I need to create service principals in Azure AD, and how can I resolve this error?

Answer 1

Hello François Girinon,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having "Insufficient privileges" error when creating service principal with az ad sp create-for-rbac.

This is a common scenario due to Azure’s dual-layer permission model, which requires both Azure AD and Azure RBAC permissions to properly configure service principals.

The below steps ensure your service principal is correctly configured with the appropriate access, enabling smooth integration with services like Kubernetes CSI drivers.

• To begin, check your account has the necessary Azure AD role to create service principals by:
  • Navigate to Azure Portal > Azure Active Directory > Roles and administrators and confirm that your user is assigned one of the following roles: Application Administrator, Cloud Application Administrator, Privileged Role Administrator, or Global Administrator.
  • These roles are essential for managing app registrations.
• Next, verify your Azure RBAC role to ensure you can assign roles to the service principal. Run the following command to check your current role assignments using bash command: az role assignment list --assignee <your-user-id>
  • You should have either the Owner or User Access Administrator role at the subscription or resource group level where you're assigning permissions. For more information, refer to the https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps
• Additionally, check the App Registration Policy under Azure AD > User settings > App registrations. Make sure the setting "Users can register applications" is enabled. If it’s disabled, you’ll need a Global Administrator to turn it on. This setting is crucial for allowing users to create app registrations.
• If you find that you lack the necessary permissions, you’ll need to request assistance from an administrator. They can create the service principal and assign the required role using the following bash command: az ad sp create-for-rbac --name "k3s-csi-driver" --role Contributor --scope /subscriptions/{subid}/resourceGroups/{resource}
• https://learn.microsoft.com/en-us/cli/azure/azure-cli-sp-tutorial-1?view=azure-cli-latest
• https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.