Azure Owner Role cannot create Resource Group

Question

I am assigned an owner role in my Employer's Azure subscription. He was able to create resource groups, but I can't. We're both wondering why since I was already assigned as Owner, the highest role aside from subscription level.

When I try the az group create --name myGroup -l southeastasia command, its response is

The client 'live.com#<myAccount>@outlook.com' with object id '<object ID>'
does not have authorization to perform action 'Microsoft.Resources/subscriptions/
resourcegroups/write' over scope '/subscriptions/<subscription>/resourcegroups/<myGroup>'.

Edit: I have no subscription level resources

Answer 1

Do you have multiple subscriptions in your tenant? If yes, you should set it.

##list subscription
az account list --output table

##change the active subscription
az account set --subscription "My Demos"

If you only have a subscription, I suggest you could create a sp, then use the sp to create a new resource group. See this link .

Update:

You should give Owner role on subscription level, according to your screenshot, you give Owner role on resource group role, you only create resources in the resource group. You also could not create new resource group. You should give Owner role to your subscription,like below:

Answer 2

Note: This issue is more likely to happen in newer subscriptions and usually happens if a certain resource type has never been created before in that subscription.

Subscription admins often fix this issue by granting resource group owners contributor rights on the subscription level which contradicts with their strategy of isolating access down to the level of resource group level not the subscription level.

For root cause and quick resolution, refer " Common problem when using Azure resource groups & RBAC" .

Answer 3

好吧，错误清楚地表明你没有对范围的权利，所以你要么是错误子的所有者，要么你有一个特别限制它的角色。