Access Request - Azure Policy/Management Group RBAC

Question

Access Request - Azure Policy/Management Group RBAC

Cedric Garner 0 Microsoft Employee

I am attempting to deploy an Azure AI Foundry resource and am being blocked by policy evaluation due to missing permission to read a management group–level policy assignment.

Error: The client '******@xxxxxxxxxx.com' does not have authorization to perform action 'Microsoft.Authorization/policyAssignments/read' over scope '/providers/Microsoft.Management/managementGroups/4ab550xxxxxxxxxxxxxxxxx/providers/Microsoft.Authorization/policyAssignments/CloudGov_AISer_DLPEnable'

Requesting RBAC assignment that grants: Microsoft.Authorization/policyAssignments/read

At scope: /providers/Microsoft.Management/managementGroups/4ab550xxxxxxxxxxxxxxxxxxxxx

Required to deploy Azure AI Foundry resources in compliance with CloudGov AI Service DLP policy.

Martin Šamudovský 180 Reputation points

2026-04-15T20:41:36.6+00:00

Hi Cedric, The error you’re seeing indicates that your account doesn’t have the required RBAC permissions to read policy assignments at the management‑group level. Since Azure AI Foundry deployments must validate compliance policies during provisioning, the missing Microsoft.Authorization/policyAssignments/read permission is blocking the deployment.

The next step is to have the appropriate admin team assign you a role that includes this permission at the management‑group scope you listed. Once that access is granted, policy evaluation should complete successfully and allow the deployment to proceed.

Hope this helps, Martin.

Note: The response is drafted with the help of AI systems.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-15T21:22:30.5866667+00:00
Hello Cedric Garner,

This is happening because your deployment needs to read a policy assignment at the management group level, and your account doesn’t have access to that scope.

Access at subscription or resource group level isn’t enough in this case. Azure Policy still needs read access to the assignment defined at the management group.

You’ll need a role at this scope: /providers/Microsoft.Management/managementGroups/4ab550bexxxxxxxxxxxx

Any of the below would work:

Reader

or a custom role with Microsoft.Authorization/policyAssignments/read

If you don’t have rights to assign roles there, please reach out to your management group admin.

Once that access is granted, the deployment should go through.

Hope this helps! Feel free to reach out for further queries.

Your answer

Martin Šamudovský 180 Reputation points

2026-04-15T20:41:36.6+00:00

Hi Cedric, The error you’re seeing indicates that your account doesn’t have the required RBAC permissions to read policy assignments at the management‑group level. Since Azure AI Foundry deployments must validate compliance policies during provisioning, the missing Microsoft.Authorization/policyAssignments/read permission is blocking the deployment.

The next step is to have the appropriate admin team assign you a role that includes this permission at the management‑group scope you listed. Once that access is granted, policy evaluation should complete successfully and allow the deployment to proceed.

Hope this helps, Martin.

Note: The response is drafted with the help of AI systems.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-04-15T21:22:30.5866667+00:00

Hello Cedric Garner,

This is happening because your deployment needs to read a policy assignment at the management group level, and your account doesn’t have access to that scope.

Access at subscription or resource group level isn’t enough in this case. Azure Policy still needs read access to the assignment defined at the management group.

You’ll need a role at this scope: /providers/Microsoft.Management/managementGroups/4ab550bexxxxxxxxxxxx

Any of the below would work:

Reader

or a custom role with Microsoft.Authorization/policyAssignments/read

If you don’t have rights to assign roles there, please reach out to your management group admin.

Once that access is granted, the deployment should go through.

Hope this helps! Feel free to reach out for further queries.