No Owner on Subscription — Cannot Manage Resources, Costs Increasing 🚨

Question

Hi Azure Community,

I'm in a frustrating situation and need urgent help. Here's the full context:

Problem:

My subscription azure-learning (ID: <PII Removed> has NO Owner role assigned to any human user. I am the billing account owner (MicrosoftCustomerAgreement, Active) but my account <PII Removed> has zero RBAC access on the subscription.

What I've tried:

• az role assignment list --role Owner → returns empty []
• Only role assignment found is a Service Principal with Contributor role
• az role assignment create --role Owner → AuthorizationFailed (no permission to assign roles)
• Portal shows "You don't have access" (Error 401)
• Cannot deallocate VM or stop Logic Apps via CLI

Current Impact:

• Logic Apps: ₹7,530
• Virtual Machines: ₹3,091
• Total this month: ₹11,042 and rising
• Forecast: ₹17,967 by month end

My Account Details:

<PII Removed>

Questions:

1. How did this happen subscription with no human Owner?
2. Is there any way to self-assign Owner role via billing account access?
3. Is Microsoft Support the only option here?

Any help is greatly appreciated. Costs are increasing every hour!

Answer 1

Hello Pratish Ninawe

Thank you for posting your query on the Microsoft Q&A platform.

What you're seeing is a known scenario, and there is a clear path forward. Let me address your three questions directly and then walk you through the recovery steps backed by official Microsoft documentation.

1. How did this happen — a subscription with no human Owner?

In Azure, billing roles and Azure RBAC roles are two separate permission systems. Being a Billing Account Owner on a Microsoft Customer Agreement (MCA) gives you full control over invoices, payments, and billing role assignments, but it does not automatically grant you any RBAC role (Owner/Contributor/Reader) on the subscriptions or resources created under that billing account.

Reference: Understand Microsoft Customer Agreement administrative roles in Azure

So a subscription can end up in a state where the only remaining RBAC assignment is a Service Principal (which matches what az role assignment list returned for you), with no human Owner. This typically happens when the subscription was originally created/managed by another identity (user or SPN) whose RBAC assignment was later removed, or when the original creator was a guest whose object reference changed.

2. Is there a way to self-assign Owner via your billing account access?

The Billing Account Owner role on its own cannot assign Azure RBAC roles on a subscription that's confirmed in the MCA roles documentation linked above. However, there is one official self-serve recovery path that works in your exact scenario:

Elevate Access (Global Administrator path): If you are a Global Administrator in the Microsoft Entra tenant the subscription is linked to (<PII Removed>f620d0385ac0), you can temporarily assign yourself the User Access Administrator role at the root scope (/), then grant yourself Owner on the subscription, and then remove the elevation. This is the officially supported recovery method documented by Microsoft:

Reference: Elevate access to manage all Azure subscriptions and management groups

Steps :

1. Sign in to the Azure portal as a Global Administrator.
2. Go to Microsoft Entra ID → Properties.
3. Under Access management for Azure resources, set the toggle to Yes, then Save.
4. Sign out and sign back in so the new permissions take effect.
5. Open Subscriptions → azure-learning → Access control (IAM) → Add role assignment, and assign yourself the Owner role.
6. Return to Microsoft Entra ID → Properties and set the toggle back to No to remove the root-scope access (recommended for security hygiene).

Then verify:

az role assignment list --assignee 435661fc-2b35-4255-87f8-78e579f85086 --scope /subscriptions/ab7d1e08-27f4-4cb3-a766-1193e61eb0b4

A related companion document for assigning a user as a subscription administrator (the Owner role assignment itself) is here:

Reference: Add or change Azure subscription administrators

One important note for your account specifically: Your UPN (<PIIRemoved>.1006_gmail.com#EXT#@…) is a guest identity. Guest accounts can be made Global Administrators in the home tenant, but only if a member admin in that tenant promotes you. If no one currently holds Global Administrator in 003f1490-1db1-4d1f-9618-f620d0385ac0, the Elevate Access path will not be available to you, and you'll need to go through Microsoft Support.

3. Is Microsoft Support the only option?

Only if the Elevate Access path above is not available to you. If you cannot become a Global Administrator in the tenant, then yes opening a Subscription Management / Billing support request is the official next step. The good news is that billing and subscription management support is free on all support plans, and you can raise it using your Billing Account Owner access (you don't need RBAC on the subscription to file it).

How to open it:

• Azure portal → Help + Support → Create a support request
• Issue type: Subscription management
• Problem type: Recover access to a subscription / Transfer ownership
• Provide your UPN, Object ID, Tenant ID, Subscription ID, the empty az role assignment list output, and your MCA Billing Account Owner proof.

For reference, this exact orphaned-subscription-with-MCA-billing-access scenario has been confirmed on Microsoft Q&A as resolvable through Elevate Access (when Global Admin is available) or through a billing support ticket otherwise:

https://learn.microsoft.com/en-us/answers/questions/2184029/cant-transfer-billing-ownership-of-orphaned-azure

Since your charges are accumulating, one action you can take as MCA Billing Account Owner (no RBAC required) is to cancel the subscription from the billing portal:

• Cost Management + Billing → Billing scopes → your MCA billing account → Subscriptions → azure-learning → Cancel subscription

Cancelling stops billable resources but retains your data for 90 days, so once Owner access is restored, you can reactivate the subscription within that window with no data loss. Reference:

Microsoft Customer Agreement documentation – Manage subscriptions

If you can confirm whether anyone currently holds Global Administrator in tenant 003f1490-1db1-4d1f-9618-f620d0385ac0, we can quickly pinpoint which of the two recovery paths applies to you.

Hope this helps you regain access quickly and stop the cost increase. If anything is still unclear, please share the output of the steps above and we'll take it from there.

Thanks,

Suchitra.