I can't access an Azure resource that is created by me and I am the tenant root admin

Question

It is so weird. I can't access this resource (Azure function). Please resolve this asap.

Answer 1

Hello II,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you can't access an Azure resource that is created by you despite you're the tenant root admin.

This simply means the account currently using to access the resource does not have an effective Azure RBAC assignment on the subscription, resource group, or Function App. Creating a resource does not permanently grant ownership, and Microsoft Entra administrative roles are separate from Azure resource permissions. A Global Administrator does not automatically receive Owner or Contributor access to Azure resources. [- https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin, and https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

The recommended fix is to:

• Verify you are signed into the correct tenant and subscription.
• Confirm the Function App still exists through Azure Resource Manager.
• Temporarily elevate access using Microsoft Entra ID > Properties > Access management for Azure resources if you are an active Global Administrator.
• Review your effective Azure RBAC assignments.
• Assign the appropriate Azure role (typically Contributor for management or Reader for visibility) at the resource-group scope.
• Refresh authentication and retest access.
• Investigate deny assignments, PIM activation, Conditional Access policies, and Activity Logs only if ARM access still fails after RBAC validation. - https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments

If the issue persists after RBAC correction, use the Request ID or Correlation ID from the failed request to identify the backend cause through Azure Activity Logs or contact Azure Support via your Azure portal. - https://learn.microsoft.com/azure/role-based-access-control/troubleshooting, https://learn.microsoft.com/azure/role-based-access-control/role-assignments-cli Check the associated links for more steps and reading to fix it.

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

---

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

Answer 2

Hi @II ,

Welcome to Microsoft Q&A and thank you for posting your question.

Based on the screenshot, the Azure portal is returning Error** Code 401 (No ****access). Although you mentioned that you created the Azure Function and are the Tenant Root **Administrator, Microsoft Entra ID administrative roles and Azure RBAC permissions are separate. Being a Tenant Root Administrator does not automatically grant access to Azure subscriptions or resources.

The error suggests that your account is authenticated successfully, but it does not currently have sufficient Azure RBAC permissions to access the Function App or its resource group.

Recommended checks

1.** Verify Azure RBAC role **assignments

Ensure your account has an appropriate role such as:

• Owner
• Contributor
• User Access Administrator
• Website Contributor (for Function Apps)

at one of the following scopes:

• Function App
• Resource Group
• Subscription

Navigate to:

Subscription** → Access Control (IAM) → Role **Assignments

and verify your account is listed.

2.** Elevate access (important for Tenant Root **Administrators)

If you are a Global Administrator/Tenant Root Administrator, try enabling:

Microsoft** Entra ID → Properties → Access management for Azure **resources

This grants temporary User** Access **Administrator permissions at the root scope, allowing you to assign yourself the appropriate RBAC role on the subscription.

3.** Verify the correct subscription and **tenant

Please confirm:

• You are signed into the correct Microsoft Entra tenant.
• The correct subscription is selected.
• The subscription is active and has not been transferred or disabled.

4.** Check whether the resource still **exists

If possible, verify whether the Function App is visible under its Resource Group or whether the same access error occurs there as well.

Could you please share:

• The output from the "Copy** error **details" button.
• Whether other resources in the same subscription are accessible.
• Whether this affects only the Function App or all resources within the subscription.

This information will help determine whether the issue is due to RBAC permissions, subscription access, tenant context, or a recent administrative configuration change.

If the assistance was helpful, kindly take a moment to click on Accept Answer and click on Yes. It will be helpful for other community members.

Answer 3

Hey there, II

When reading your question, and looking at the situation you are facing, I am thinking this may be down to you not having the correct role for that subscription/resource. While you are a root/tenant admin, this doesn't automatically apply the owner/contributor to the subscription/resource on Azure. This has to be done manually.

Please can you sign into your account on the subscription blade here: https://portal.azure.com/#view/Microsoft_Azure_Billing/SubscriptionsBladeV2

Please can you click onto the subscription the Azure function has been created on, then click onto "Access Control (IAM)" from the left-hand navigation menu.

Please can you click onto "View my access"

Then check you have either "Owner" or "Contributor" role for that subscription. If you have, please can you sign into the resources blade here: https://portal.azure.com/#servicemenu/Microsoft_Azure_Resources/ResourceManager/browseAll

Click onto the Azure Function resource, then follow the same steps above to view the access control and view what access you have for that resource.

If you find you do not have the owner or contributor role for your subscription or resource, please speak to an administrator who has the owner role and see if they can assign the role for you. Only the person who has the owner role is able to assign or remove permissions from the resource or subscription. To learn more about Azure Role Based Access Control (RBAC), please visit this article: https://learn.microsoft.com/en-us/azure/role-based-access-control/overview

Hope this helps,
Nathan