I have the Application Developer role assigned in Microsoft Entra ID. When I open App Registrations in the Azure portal, my applications appear briefly with their names and details, but then the page changes to "You don't have access." The registrations were originally created from my account, and I'm still listed as one of their owners. The portal shows this error: {"sessionId":"xxx","subscriptionId":"","resourceGroup":"","errorCode":"401","resourceName":"","details":"Error loading your content"}. I can currently request temporary access to individual registrations through PIM, but activating that access doesn't let me create new registrations. Could this be caused by Conditional Access, a tenant setting, or a missing directory permission? Can an administrator use the session ID to determine what changed?
3 Answers
There are two separate issues here. Application Developer can allow certain application-management tasks, but creating new registrations may depend on the tenant’s app-registration policy or a higher Entra role such as Application Administrator or Cloud Application Administrator. If the tenant previously allowed all users to create registrations and that setting was tightened, your developer role would not necessarily restore that ability.
Application ownership alone may not be enough to load the App Registrations list. Assigning Directory Readers alongside Application Developer commonly resolves this because the portal needs directory-level read permissions to enumerate the applications. An owner can still be unable to see or manage an app if they lack those directory permissions.
Also check whether the role is eligible rather than permanently active in Privileged Identity Management. The correct account and tenant should be selected, and any eligible role must be activated before opening the portal. An administrator can review your directory audit and sign-in logs around the time of the failure; the session ID may help correlate the event, but the more important checks are your current role assignments, directory permissions, PIM activation, and the tenant’s registration policy.
I confirmed that I’m using the right tenant and that I’m still an owner. Activating access for one application works temporarily, but it doesn’t restore the ability to create new registrations, so the tenant policy or missing directory-level role seems more likely than Conditional Access.
That matches what changed in my case. I was an owner, but adding the directory read permission restored access to the registrations.