How to give an existing Azure user a "global administrator" rights via Azure CLI on tenant level ? (not subscription level)

Question

How to give an existing Azure user a "global administrator" rights via Azure CLI on tenant level ? (not subscription level)

Ashok Kumar Gupta 5

1 answer

Your answer

Answer 1

CarlZhao-MSFT 46,366

Hi anonymous user

First, log in to the Azure CLI using the global administrator. Note that you must log in with a global administrator, as only a global administrator can grant administrator roles for users.

az login

Next, use the Graph api to grant a tenant-wide global administrator role for your users.

$Body="{'principalId':'{user object id}', 'roleDefinitionId': '62e90394-69f5-4237-9190-012177145e10', 'directoryScopeId': '/'}"  
az rest --method POST --uri https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments --headers "Content-Type=application/json" --body $Body

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

CarlZhao-MSFT 46,366 Reputation points

2022-05-05T02:14:23.217+00:00

Hi anonymous user Would you please provide us with an update on the status of your issue?
Zehui Yao_MSFT 5,876 Reputation points

2022-05-10T10:19:27.07+00:00

Hi anonymous user, Did you refer to Carl's answer above? Is it helpful to you? Comment here when you still need any help
Zehui Yao_MSFT 5,876 Reputation points

2022-05-10T10:19:46.987+00:00

Hi anonymous user, Did you refer to Carl's answer above? Is it helpful to you? Comment here when you still need any help.
Ashok Kumar Gupta 5 Reputation points

2022-05-11T10:23:01.303+00:00

![200975-image.png][1] See the error message [1]: /api/attachments/200975-image.png?platform=QnA az>> $Body="{'******@ashoktechie.com':'e3bdd470-9eb6-4635-b99f-d7a3cebc1c2d', 'roleDefinitionId': '62e90394-69f5-4237-9190-012177145e10', 'directoryScopeId': '/'}" Success: 0 az>> rest --method POST --uri https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments --headers "Content-Type=application/json" --body $Body Bad Request({"error":{"code":"BadRequest","message":"Unable to read JSON request payload. Please ensure Content-Type header is set and payload is of valid JSON format.","innerError":{"date":"2022-05-11T10:18:17","request-id":"42e665b2-e5cb-441a-93f3-87983693bd21","client-request-id":"42e665b2-e5cb-441a-93f3-87983693bd21"}}}) az>>
CarlZhao-MSFT 46,366 Reputation points

2022-05-12T08:00:14.693+00:00
Hi anonymous user

There is an error in your command line, please change it to:

$Body="{'principalId':'{user object id}', 'roleDefinitionId': '62e90394-69f5-4237-9190-012177145e10', 'directoryScopeId': '/'}" az rest --method POST --uri https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments --headers "Content-Type=application/json" --body $Body

I have tested the command locally and it works flawlessly and grants the user the global administrator role.

----------

--please don't forget to upvote and Accept as answer if the reply is helpful--
Ashok Kumar Gupta 5 Reputation points

2022-05-12T12:54:52.577+00:00

I posted my comments plz see

Unable to add existing user as global admin using Azure CLI
Ashok Kumar Gupta 5 Reputation points

2022-05-12T12:56:32.413+00:00

@CarlZhao-MSFT & @Zehui Yao_MSFT looping you both please assist see the screenshots of error message

az>> $Body="{'******@ashoktechie.com':'e3bdd470-9eb6-4635-b99f-d7a3cebc1c2d', 'roleDefinitionId': '62e90394-69f5-4237-9190-012177145e10', 'directoryScopeId': '/'}"
Success: 0
az>> rest --method POST --uri https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments --headers "Content-Type=application/json" --body $Body
Bad Request({"error":{"code":"BadRequest","message":"Unable to read JSON request payload. Please ensure Content-Type header is set and payload is of valid JSON format.","innerError":{"date":"2022-05-11T10:18:17","request-id":"42e665b2-e5cb-441a-93f3-87983693bd21","client-request-id":"42e665b2-e5cb-441a-93f3-87983693bd21"}}})
az>>

I tried both in Normal mode and interactive mode
CarlZhao-MSFT 46,366 Reputation points

2022-05-13T01:28:34.417+00:00
Hi anonymous user

There is an error in your command line, please change it to:

$Body="{'principalId':'{user object id}', 'roleDefinitionId': '62e90394-69f5-4237-9190-012177145e10', 'directoryScopeId': '/'}" az rest --method POST --uri https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments --headers "Content-Type=application/json" --body $Body

I have tested the command locally and it works flawlessly and grants the user the global administrator role.

----------

--please don't forget to upvote and Accept as answer if the reply is helpful--

Share via

How to give an existing Azure user a "global administrator" rights via Azure CLI on tenant level ? (not subscription level)

1 answer

Your answer