In Access Control(IAM), I cant able to assign roles. Its disabled

Question

Answer 1

Hi Riyass Ibrahim
It looks like the “Add role assignment” button is greyed-out because your signed-in account doesn’t have the right IAM permissions at that scope. In Azure RBAC you need the Microsoft.Authorization/roleAssignments/write action—typically Owner or User Access Administrator—to assign roles. Here’s what you can try:

1.Verify your current permissions

• Go to your subscription (or resource group) > Access control (IAM) > View my access.
  • If you don’t see Owner or User Access Administrator, you won’t be able to assign roles.

2.Ask an existing Owner or User Access Administrator to grant you the needed role

They can use the same Access control (IAM) blade and click Add > Add role assignment to give you Owner or User Access Administrator.

3.If you’re a Global Administrator in Entra ID but still can’t assign roles at the subscription level, “elevate access”

In the subscription’s IAM blade go to Settings (at the top) and enable “Enable global administrator to manage subscription”.

This lets Entra Global Admins act as full Owner on the subscription.

4.Wait a few minutes and sign out/in again

• IAM changes can take 5–10 minutes to propagate.

Follow-up questions if you’re still stuck:

• Which Azure directory and subscription are you signed into?

• What role(s) do you see under View my access?

• Are you a Global Administrator in Entra ID?

• Do you see the Settings option on the IAM blade to elevate access?

References

• Assign Azure roles using the Azure portal: https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal
• Troubleshoot Azure RBAC role assignment issues: https://docs.microsoft.com/azure/role-based-access-control/troubleshooting
• Azure built-in roles (Owner, User Access Administrator, etc.): https://docs.microsoft.com/azure/role-based-access-control/built-in-roles
• Elevate access for Global Administrators on a subscription: https://docs.microsoft.com/azure/cost-management-billing/manage/elevate-access-global-admin

Please let me know if you face any challenge here, I can help you to resolve this issue further

Provide your valuable Comments.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Answer 2

In the Access control (IAM) blade, the Add > Add role assignment option is disabled when the signed-in identity does not have permission to create role assignments at that scope.

To enable it, the identity must be assigned a role that includes the Microsoft.Authorization/roleAssignments/write permission at the subscription (or higher) scope, for example the Role Based Access Control Administrator built‑in role.

Sign in with an account that already has such a role at the subscription (or management group/tenant) level, then assign an appropriate role (such as Role Based Access Control Administrator) to the intended admin account. After that, when that account opens Access control (IAM) for the subscription or resource, Add role assignment will be enabled.

---

References:

• Troubleshoot Azure RBAC
• Assign Azure roles using the Azure portal
• Tutorial: Grant a user access to Azure resources using the Azure portal