I'm running into an issue where my Global Admin account is unable to create resource groups due to a permissions error. The error message indicates that I don't have the necessary permissions for the subscription. I understand that you need to be an owner of the subscription to create a resource group, but I can't figure out how to assign that ownership to myself if I'm not already set as an owner. Can anyone guide me through the process?
2 Answers
Global Admins need to elevate their permissions for Azure. To create a resource group, you actually need the Contributor role, not necessarily ownership. If you need help assigning roles, check out some of the Microsoft documentation, like the [Elevate access to manage all Azure subscriptions](https://learn.microsoft.com/azure/role-based-access-control/elevate-access-global-admin?WT.mc_id=studentamb_165290). It sounds like you might benefit from brushing up on some basics too, like the [Azure Fundamentals course](https://learn.microsoft.com/training/courses/az-900t00/?WT.mc_id=studentamb_165290)!
The distinction here is important: being a Global Admin (an Entra Role) doesn't automatically give you permissions in Azure. To create resource groups, you actually need at least the Contributor role at the subscription level. You can grant yourself this role by going to the Azure portal, enabling ‘Access management for Azure resources’, and then assigning yourself either the Contributor or Owner role on your subscription. Just remember to disable that access management setting afterwards!
I tried to assign the role as eligible, but it never showed up for me to activate under ‘My Roles’. I eventually had to make a permanent assignment to get it to work.