azureazure-devopsazure-active-directoryazure-web-roles

Azure global admin cannot(disabled) add roles under "Access Control(IAM)"

I activated my global admin role in Privileged Identity Management like so enter image description here

When I navigate to the Access Control blade under a subscription, I see the Add role assignment options disabled.

enter image description here

Doesn't global admin has global rights and can do this?

Thanks

Solution

  • Doesn't global admin has global rights and can do this?

    No. You're global admin in your Azure AD so you can perform all operations in Azure AD. Azure AD roles are different than Azure Subscription roles.

    To be able to perform IAM related activities in an Azure Subscription, you must be assigned an Owner or User Access Administrator role in that Azure Subscription.

    Considering you're the global admin in your Azure AD, you can elevate your permissions to perform IAM activities in Azure Subscription. Please see this link for more details: https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin.

    Other option would be to ask someone in your team with proper access in the Azure Subscription to assign you in Owner or User Access Administrator role.