Role Assignment error

Question

HI,

Logged in as a Global Administrator and was trying to assign a role and getting the following error

New-AzRoleAssignment : The client 'email id' with object id 'axxx'
does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope
'/providers/Microsoft.Authorization/roleAssignments/xx' or the scope is invalid. If
access was recently granted, please refresh your credentials.

Answer 1

Hi @Hari Vidya Sankar ,

You need to have "User Access Administrator" or "Owner" Permissions to assign specific roles to a resource as these roles has Microsoft.Authorization/roleAssignments/write permissions which normally Global Administrator doesn't have. GA can mange all aspects of Azure AD but managing resources you need to other RBAC permissions. Here is the documentation for your reference.

Please let me know if you have any other questions.

Thanks
Saurabh

----------

Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.

Answer 2

Check that you're currently signed in with a user that is assigned a role that has the Microsoft.Authorization/roleAssignments/write permission such as Role Based Access Control Administrator at the scope you're trying to assign the role Or Assign Owner role, However, this is not a best practice as security principals

Answer 3

Check that you're currently signed in with a user that is assigned a role that has the Microsoft.Authorization/roleAssignments/write permission such as Role Based Access Control Administrator at the scope you're trying to assign the role Or Assign Owner role, However, this is not a best practice as security principals