issues with role assignments

Question

issues with role assignments

Tom Shelton 0

So we have a Microsoft account for email/azure, no azure subscription. We went and added a new Pay as You Go subscription. I used my same corporate email account. Logged in to that Pay As you go and invited an external user. That user accepted. Add them as Privledged User/Contributor. When they log in and switch to our account to do their work/provision resources etc, there is no subscription listed. So you go to New Web App, no subscription in the dropdown. If I the owner do that the subscription is visible and I can provision. Its like they are in the "other" Azure account (wrong billing scope). And I have no idea how to resolve this. Please advise. This is a stop work condition.

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-05T22:11:56.0033333+00:00
Hello Tom Shelton

The problem arises from the external user's access to the tenant but lack of RBAC access at the Microsoft Azure subscription level.

Fix:

Go to Subscriptions in the Azure portal.

Select the Pay-As-You-Go subscription.

Open Access Control (IAM) → Add role assignment.

Assign Contributor to the external user.

After that, request that the user change their portal directory or sign out and back in. After that, when generating resources, the subscription will be visible.

Note: Access to Azure subscriptions is not automatically granted by Microsoft Entra ID roles, such as Privileged Role Administrator.

Let me know if any further queries - feel free to reach out!
Tom Shelton 0 Reputation points

2026-03-06T16:05:24.6966667+00:00

I appreciate the response but this does not fix my problem. We tried these steps yesterday before i submitted the issue for help. is there something else we need to do? If necessary we can get on a call directly if that helps.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-06T17:08:33.48+00:00

deleted
Tom Shelton 0 Reputation points

2026-03-06T17:43:13.2633333+00:00

We only have two accounts visible when I login as owner. We had added a new one with Pay as you Go. We also added a Pay as you Go to the legacy account. So now, both accounts have a Pay as you Go subscription active. So again there are only two accounts and both have an Azure Pay as you Go attached. We deleted the permissions for our Consultant, deleted them, re-invited them, and re-added them as Privledged/Contributer in the IAM add role area. When they login it STILL says no subscriptions when they login and switch to our account. We are out of ideas. Please dont give me another boilerplate FAQ non-answer. This is a stop work condition for us.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-06T18:54:30.1433333+00:00

Hello Tom Shelton, Thank you sharing the details, will check internally and get back to you!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-09T17:51:22.53+00:00
Hello Tom Shelton The most likely reason is that the subscription is linked to a different directory (tenant) than the one the guest user is transferring to, as the user has already been re-invited and RBAC has been reallocated.

Please verify this in Microsoft Azure:

Go to Subscriptions → Pay-As-You-Go subscription.

Check the Directory (tenant) the subscription is linked to.

Ensure the external user was invited to that same tenant.

Even if RBAC roles are assigned, the guest user will not view the subscription if it is linked to another directory. Once the directory has been verified, request that the user either switch to that directory or sign in and out of the portal once more.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-10T20:59:25.3733333+00:00

Hello Tom Shelton Any update on the issue?
Tom Shelton 0 Reputation points

2026-03-11T19:40:00.34+00:00

the issue is still not resolved. We had previously done the steps you have provided multiple time but the contributor we have add still cannot see what he needs to. I am not sure what else we need to do. If you need to or want to log in and see what we see I am willing to do that at your convenience. You can call me directly at PII
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-18T19:47:39.1566667+00:00

Tom Shelton, Lets continue over private messages!

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-05T22:11:56.0033333+00:00

Hello Tom Shelton

The problem arises from the external user's access to the tenant but lack of RBAC access at the Microsoft Azure subscription level.

Fix:

Go to Subscriptions in the Azure portal.

Select the Pay-As-You-Go subscription.

Open Access Control (IAM) → Add role assignment.

Assign Contributor to the external user.

After that, request that the user change their portal directory or sign out and back in. After that, when generating resources, the subscription will be visible.

Note: Access to Azure subscriptions is not automatically granted by Microsoft Entra ID roles, such as Privileged Role Administrator.

Let me know if any further queries - feel free to reach out!
Tom Shelton 0 Reputation points

2026-03-06T16:05:24.6966667+00:00

I appreciate the response but this does not fix my problem. We tried these steps yesterday before i submitted the issue for help. is there something else we need to do? If necessary we can get on a call directly if that helps.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-06T17:08:33.48+00:00

deleted
Tom Shelton 0 Reputation points

2026-03-06T17:43:13.2633333+00:00

We only have two accounts visible when I login as owner. We had added a new one with Pay as you Go. We also added a Pay as you Go to the legacy account. So now, both accounts have a Pay as you Go subscription active. So again there are only two accounts and both have an Azure Pay as you Go attached. We deleted the permissions for our Consultant, deleted them, re-invited them, and re-added them as Privledged/Contributer in the IAM add role area. When they login it STILL says no subscriptions when they login and switch to our account. We are out of ideas. Please dont give me another boilerplate FAQ non-answer. This is a stop work condition for us.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-06T18:54:30.1433333+00:00

Hello Tom Shelton, Thank you sharing the details, will check internally and get back to you!
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-09T17:51:22.53+00:00

Hello Tom Shelton The most likely reason is that the subscription is linked to a different directory (tenant) than the one the guest user is transferring to, as the user has already been re-invited and RBAC has been reallocated.

Please verify this in Microsoft Azure:

Go to Subscriptions → Pay-As-You-Go subscription.

Check the Directory (tenant) the subscription is linked to.

Ensure the external user was invited to that same tenant.

Even if RBAC roles are assigned, the guest user will not view the subscription if it is linked to another directory. Once the directory has been verified, request that the user either switch to that directory or sign in and out of the portal once more.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-10T20:59:25.3733333+00:00

Hello Tom Shelton Any update on the issue?
Tom Shelton 0 Reputation points

2026-03-11T19:40:00.34+00:00

the issue is still not resolved. We had previously done the steps you have provided multiple time but the contributor we have add still cannot see what he needs to. I am not sure what else we need to do. If you need to or want to log in and see what we see I am willing to do that at your convenience. You can call me directly at PII
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-03-18T19:47:39.1566667+00:00

Tom Shelton, Lets continue over private messages!