4

I activated my global admin role in Privileged Identity Management like so enter image description here

When I navigate to the Access Control blade under a subscription, I see the Add role assignment options disabled.

enter image description here

Doesn't global admin has global rights and can do this?

Thanks

Tiju John
  • 933
  • 11
  • 28

2 Answers2

3

Doesn't global admin has global rights and can do this?

No. You're global admin in your Azure AD so you can perform all operations in Azure AD. Azure AD roles are different than Azure Subscription roles.

To be able to perform IAM related activities in an Azure Subscription, you must be assigned an Owner or User Access Administrator role in that Azure Subscription.

Considering you're the global admin in your Azure AD, you can elevate your permissions to perform IAM activities in Azure Subscription. Please see this link for more details: https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin.

Other option would be to ask someone in your team with proper access in the Azure Subscription to assign you in Owner or User Access Administrator role.

Gaurav Mantri
  • 128,066
  • 12
  • 206
  • 241
  • Same issue for me, but following that above guide (ms docs weblink) doesnt allow me to elevate myself as the azure account owner. Under Access management for Azure resources, the toggle buton is greyed out. – OJB1 Mar 25 '23 at 18:49
2

Azure roles happen to be different than Azure AD roles. enter image description here enter image description here

By default AD roles manage AD and azure roles manage azure resources. However there are some cross roles which can access resources across when needed. more information here

enter image description here

Since Global Administrator is a cross-service role, he can elevate himself by granting himself the user access administrator role as here. Then I was able to see the disabled options, enabled.

more information

Tiju John
  • 933
  • 11
  • 28
  • another thing I learnt today is that an organization can configure additional policies to disable that option under AAD-properties. https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults – Tiju John Jun 03 '21 at 08:24