I cannot assign any RBAC role at the Root Management Group scope

Question

Hi everyone, I’m having an issue with my Root Management Group in Azure.

I cannot assign any RBAC role to any user or service principal at the Root Management Group scope. Every role assignment fails with AuthorizationFailed, even when using:

Global Administrator

Privileged Role Administrator

The initial tenant admin (rootadmin)

Azure CLI

Azure REST API

In the Azure Portal, the Root Management Group appears with “Assignment: Disabled”, and the portal does not allow adding any permissions at that level.

The option “Enable management group hierarchy” does not appear in my subscription, so I cannot re‑enable or repair the hierarchy.

It looks like my Root Management Group is in an orphaned / inconsistent state, where the scope exists but no RBAC administrator is assigned and no role assignments can be created.

Any guidance on how to recover or repair the Root Management Group hierarchy would be greatly appreciated.

Thanks!

Answer 1

Hello @Daniel Ayuga , I hope you are doing well,

Welcome to Microsoft Q&A.

Having Global Administrator or Privileged Role Administrator in Microsoft Entra ID does not automatically grant Azure RBAC permissions at the tenant root scope.

Since you are a Global Administrator, you can temporarily elevate your access to obtain User Access Administrator at the root scope:

1. Sign in to the Azure portal as a Global Administrator.
2. Go to Microsoft Entra ID → Properties.
3. Under Access management for Azure resources, set the option to Yes and save.
4. Sign out and sign back in to refresh your permissions.
5. Go to the Root Management Group → Access control (IAM) and assign the required RBAC role.
6. Once finished, return to Microsoft Entra ID → Properties and set Access management for Azure resources back to No.

Reference: Elevate access to manage all Azure subscriptions and management groups

If my answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions.

Answer 2

Dear @Daniel Ayuga

Having Global Administrator or Privileged Role Administrator in Microsoft Entra ID doesn't automatically give you Azure RBAC permissions at the root management group.

If you need to assign a role at the tenant root scope, you first need to elevate your access.

The easiest way to do this is:

Sign in to the Azure portal as a Global Administrator. If you're using PIM, activate the role first.

Go to Microsoft Entra ID → Manage → Properties.

Under Access management for Azure resources, set the option to Yes and save it.

This gives the currently signed-in user User Access Administrator at the tenant root management scope.

Sign out and sign back in. This is important because the new permissions need to be refreshed.

You should then be able to go to the root management group and use Access control (IAM) to assign the required RBAC role.

Once you're done, I would disable the elevated access again by going back to the same Access management for Azure resources setting and changing it back to No.

So basically, being a Global Administrator in Entra ID and having Azure RBAC permissions are two separate things. The temporary elevation is what allows you to manage Azure RBAC at the root scope.

---

If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

Answer 3

Global Administrator or Privileged Role Administrator in Microsoft Entra ID does not automatically grant Azure RBAC permissions at the root management group. To assign RBAC roles at root scope, the signed-in account must first elevate access and obtain User Access Administrator at root scope (/).

Use this recovery path:

1. Sign in to the Azure portal as a Global Administrator.
   • If Privileged Identity Management is used, activate the Global Administrator role first.
2. Go to Microsoft Entra ID > Manage > Properties.
3. Under Access management for Azure resources, set the toggle to Yes, then select Save.
   • This assigns User Access Administrator in Azure RBAC at root scope (/).
   • This setting applies only to the currently signed-in user.
4. Sign out and sign back in to refresh access.
5. Open the root management group or the relevant Access control (IAM) page and create the required role assignment.
   • To assign Azure roles, the account needs Microsoft.Authorization/roleAssignments/write, such as User Access Administrator or Role Based Access Control Administrator at the target scope.
6. After the required changes are complete, remove the elevated access:
   • Return to Microsoft Entra ID > Manage > Properties
   • Set Access management for Azure resources back to No
   • Sign out again

Important checks based on the reported symptoms:

• If Add role assignment is disabled or assignments fail with AuthorizationFailed, the current account does not have effective Microsoft.Authorization/roleAssignments/write at that scope, or the role assignment is constrained by conditions.
• If roles or principals are missing in the picker, check the roles already assigned to the account and whether a condition restricts which roles or principals can be assigned.
• If access was recently granted, refresh credentials by signing out and back in.

The available guidance supports elevation and permission recovery at root scope. It does not provide a documented self-service repair procedure for an orphaned or inconsistent root management group hierarchy beyond regaining root-scope access through elevation.

---

• Elevate access to manage all Azure subscriptions and management groups
• Assign Azure roles using the Azure portal
• Troubleshoot Azure RBAC
• How to give permission inside of Management Group - Microsoft Q&A