Azure for Students account cannot access Microsoft Entra ID and User Management

Question

I am an LPU student using an active Azure for Students subscription, verified with my official LPU student email address.

I am unable to access Microsoft Entra ID and the Users/User Management section. When I try to access it, I receive the error “401 – Insufficient privileges to complete the operation.”

I have checked Switch Directory, and only the Lovely Professional University directory is available. My Azure subscription is active and I have remaining student credits.

Other students from my university who have also verified Azure for Students using their LPU email are able to access User Management and create users.

Could you please check my account or tenant configuration and let me know why I do not have access to Microsoft Entra ID and User Management, and how I can get the required access without losing my existing Azure for Students subscription?

Answer 1

Hello Kumar Anmol Pratap,

Greetings! Thanks for raising this question in the Q&A forum.

This happens because your Azure for Students subscription and your Microsoft Entra ID directory role are two completely separate things. Verifying Azure for Students with your LPU email account just activates a billing/subscription entitlement inside the existing Lovely Professional University tenant. It does not automatically grant you any administrative role in that tenant's directory. By default, every new user in a Microsoft Entra tenant is added with the standard "User" role only, which has no permission to open the Users, Groups, or other administrative blades under Microsoft Entra ID. That is exactly why you see:

401 – Insufficient privileges to complete the operation

The reason your classmates can access User Management while you cannot is that they (or their accounts) were individually assigned a directory role such as User Administrator or Global Administrator by the tenant's IT admin, most likely because they needed it for a specific course project. It is not something that comes automatically with the Azure for Students subscription itself.

Here is how to resolve it:

Confirm you are in the right tenant Since Switch Directory only shows Lovely Professional University, you are correctly signed into the tenant that owns your subscription. This confirms the issue is a missing role assignment, not a wrong-tenant sign-in problem.

Check your current role assignment Go to portal.azure.com > Microsoft Entra ID > Users > search for your own account > Assigned roles. If it only shows "User," that confirms you have no elevated directory role.

Ask your university's Global Administrator to assign you a role Only an existing Global Administrator or Privileged Role Administrator in the LPU tenant can grant you access. Since you likely do not have their contact directly, this usually needs to go through your LPU IT helpdesk or the faculty member who arranged Azure for Students access for your class. Ask them specifically to assign you the User Administrator role (or Global Administrator if your project genuinely requires full tenant control), scoped either tenant-wide or to an Administrative Unit if your admin prefers to limit blast radius.

The admin can do this from their side with:

Microsoft Entra ID > Roles and administrators > User Administrator > Add assignments > select your account

or via PowerShell (run by the admin, not you):

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
New-MgRoleManagementDirectoryRoleAssignment -PrincipalId "<your-object-id>" -RoleDefinitionId "<User Administrator role template ID>" -DirectoryScopeId "/"

1. If the university admin cannot or will not grant this Since this is an institution-owned tenant, LPU's IT policy may deliberately restrict who gets directory roles, even for coursework, and that is their prerogative to control. If your goal is simply to practice creating users, groups, and Entra ID administration for learning purposes rather than a specific class assignment tied to the LPU tenant, you have another option: create your own free Microsoft Entra tenant, where you will automatically become the Global Administrator. Go to:

portal.azure.com > Microsoft Entra ID > Manage tenants > Create a tenant

This new tenant is separate from LPU and gives you full administrative control for practice, though your existing Azure for Students subscription and its credits will remain associated with the LPU tenant and cannot be moved to the new one.

1. Do not attempt to self-assign roles There is no supported way for a standard member account to elevate its own privileges. Any third-party tool or script claiming to do this should be avoided, since it does not work and could violate your university's Acceptable Use Policy.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix