Trying to give someone permission to a Virtual Machine but they can't see it

Question

Trying to give someone permission to a Virtual Machine but they can't see it

Luke Chung 41 MVP

My person can log into the Azure Portal but when they click on Virtual Machines, they get this error:An error occured when trying to fetch resources. Additional details from the underlying API that might be helpful: Please provide below info when asking for support: timestamp = 2026-07-02T18:39:10.4479151Z, correlationId = d545e416-a917-44f8-8608-2c6ddee6086d. (Code: AccessDenied) Access is denied to the requested resource. The user might not have enough permission. (Code: AccessDenied) Try refreshing the page. Your resources aren't affected by the issue, we're just having trouble showing this view right now. To see a list of resources, select Simplified View.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

TP 163.5K Volunteer Moderator

Hi,

What roles did you assign to the person's user account and at what scope? For example, did you assign the user Contributor role to the resource group that contains the VM?

You can do this by navigating to the resource group in the portal, on left click Access control (IAM), Add -- Add role assignment, click Privileged administrator roles tab, select Contributor, click Next, click Select members, search for and select the user's account, Next, Review + assign.

After assigning role please have the user sign out of the portal and back in and then test.

Thanks.

-TP

Goutam Pratti 6,300 Reputation points Microsoft External Staff Moderator

2026-07-06T12:49:40.65+00:00

Hello @Luke Chung
I hope answer provided by @TP is helpful. Let us know if you have any queries. Happy to assist you further.
Luke Chung 41 Reputation points MVP

2026-07-06T15:18:01.5366667+00:00

She is assigned to Network Contributor so she can update the IP addresses who are allowed to connect to the VM.

Attached is what she emailed me. She also said she didn't receive an invitation to the site but I'm not sure if that's required since she's on our domain.
Luke Chung 41 Reputation points MVP

2026-07-06T15:24:30.57+00:00

I was unable to upload a 193K PNG of the screenshot. Kept getting an error File upload failed. Please try again.

Trying again gives the same failure.
Luke Chung 41 Reputation points MVP

2026-07-06T17:21:57.62+00:00

The Azure portal says the B2B Invitation is Pending acceptance, so I clicked the Resend Invitation hyperlink. Do you know what email address it comes from?

I also have the option to change it to Internal user. The challenge is the Azure subscription is under my personal version (@outlook.com) of my work account (@fmsinc.com), and her email address is part of our work domain (******@fmsinc.com).

This mess is probably due to Azure having me create a personal account on Outlook.com after we Office365 was introduced and my company email became a work account that conflicted with the personal Microsoft account. Not sure how to combine it into one as I only use the Outlook.com account to log into the Azure portal.

This is what I see on IAM for her role which should is under ******@fmsinc.com. Not sure what the @luke.fmsinc.onmicrosoft.com is all about: Azure-Madhuja.png
Luke Chung 41 Reputation points MVP

2026-07-06T21:13:33.0166667+00:00

I found the problem. I had a typo in the user's email address that prevented them receiving the invitation email. Created a new assignment and invitation.

To address the deeper problem where members of our team aren't considered part of our organization, how do I change the ownership of our subscriptions so that it uses the Work version of my email address instead of the outlook one and how would I manage the different directories I have under my work and Outlook logins? Can I just merge them?
Luke Chung 41 Reputation points MVP

2026-07-07T16:55:45.1533333+00:00

OK. My person accepted the invitation, installed the Microsoft Authenticator app, and can log into the portal. Unfortunately, they still get an error:

Please provide below info when asking for support: timestamp = 2026-07-07T16:45:26.2993322Z, correlationId = 6f8e8ce4-5471-4276-90ed-6c2749f51b6c. Try refreshing the page. Your resources aren't affected by the issue, we're just having trouble showing this view right now. To see a list of resources, select Simplified View.
Luke Chung 41 Reputation points MVP

2026-07-07T16:56:47.36+00:00
TP 163.5K Reputation points Volunteer Moderator

2026-07-08T21:04:56.2366667+00:00

Hi Luke, I've had limited access due to the recent storms knocking out power, blocking roads, etc.

Have you at least assigned Reader role to the resource group that contains the VM? Assigning Network Contributor isn't likely going to give them enough permissions to browse and view resources in the portal.

In my answer I was suggesting you assign Contributor role to the resource group since I didn't know precisely what you wanted them to be able to do. Perhaps this would be granting them more permissions than necessary.

Please note it is good idea to follow least privilege principle and only assign user the bare minimum permissions for them to accomplish their task, however, this requires you to know (or spend time researching/testing) the precise permissions required.

For example, if the only thing you want the user to be able to do is update NSG rule via portal, they will need permission to browse certain resources, plus permission to make changes to the rule. If they were making the change directly via REST API or CLI/PowerShell, then the permissions they require would likely be less.
Luke Chung 41 Reputation points MVP

2026-07-08T21:16:21.9333333+00:00

Thanks. I added them as a Contributor to the Resource Group and deleted their permissions at the VM. That has given her access to the VM, so that's great. Didn't realize the need to provide permission at the Resource Group level.
TP 163.5K Reputation points Volunteer Moderator

2026-07-08T21:27:29.52+00:00

You don't need to grant at resource group level. I suggested it because when someone is "managing" a VM they will often need access to its related resources (e.g. disk, NSG, VNet, NIC, Public IP, maintenance config, etc.) and they will likely be in same resource group.
Goutam Pratti 6,300 Reputation points Microsoft External Staff Moderator

2026-07-10T15:39:47.5366667+00:00

Hi @Luke Chung ,

Following up to see if the above answer provided by @TP was helpful. If this answers your query, do click Accept Answer and Yes, if you have any further query do let us know.