I can’t create resource like resource group on azure portal

Question

I can’t create resource like resource group on azure portal

md ullah 0

I have azure subscription and global administration role. Iusing azure portal few years. Recently I tried to use azure portal with my subscription and try to create a Resource group on azure portal but I couldn’t. I got the following message

You do not have permissions to create resource groups under subscription cf4db60b-9e1c-4576-b1a8-fec3689195d8.

0 comments

2 answers

Your answer

Answer 1

The error indicates the signed-in account does not have Azure RBAC permissions at the subscription or resource group scope to create resources. A Global Administrator role in Microsoft Entra ID does not by itself grant Azure resource permissions.

Use this path to restore access:

Sign in to the Azure portal with an account that is a Global Administrator.
Go to Microsoft Entra ID > Properties.
Under Access management for Azure resources, set the toggle to Yes.
- This adds User Access Administrator in Azure RBAC at the root scope (/).
In the Azure portal, open Subscriptions and select the affected subscription.
Open Access control (IAM).
Assign the Owner role to the required account at the subscription scope.
- To assign Azure roles, the account performing the assignment must have Microsoft.Authorization/roleAssignments/write, such as Role Based Access Control Administrator or User Access Administrator.
Wait a few minutes for role assignment propagation, then try creating the resource group again.

To create the resource group after permissions are fixed:

Sign in to the Azure portal.
Select Resource groups.
Select Create.
Choose the Subscription, enter a Resource group name, and select a Region.
Select Review + Create, then Create.

If the portal shows AuthorizationFailed, that confirms the current account still lacks write permission at the selected scope. In that case, verify the account is assigned a role with write permission on the subscription or resource group scope.

References:

Answer 2

The AI answer above gets the main point right: Global Administrator in Entra ID doesn’t give you any permissions in Azure RBAC. They’re two separate permission systems that happen to share a portal, so Global Admin was never what let you create resource groups. And yes, Elevate access is the correct route back in if the issue is simply a missing role assignment: https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin

What I’d add is that those steps assume you never had permissions in the first place. You’ve said you’ve been using the portal for years, which means you did have them and something has changed. It’s worth confirming what changed before you start fixing things, because there are a couple of situations where elevating access won’t help at all.

Before touching anything, check what you actually have right now. On the subscription, open Access control (IAM) and choose View my access. It takes seconds and tells you whether you have no role assignment at all, or whether you have one that isn’t taking effect. Those are different problems with different fixes.

Here are the two cases where Elevate access won’t get you anywhere:

1. The subscription was moved to a different tenant

If the subscription was transferred, all role assignments were wiped, and your Global Admin now sits in a different directory from the subscription itself. Elevate access only works inside the tenant that owns the subscription, so it won’t do anything here. Check the directory shown on the subscription’s Overview page and make sure it matches the one you’re signed in to.

2. A deny assignment is blocking you

Deny assignments override role assignments outright, even Owner. They don’t appear alongside your normal role assignments, and you can’t create them yourself. Azure creates them for things like deployment stacks and the older Blueprints. You can list them here: https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments If one is present, granting yourself Owner won’t change anything.

Also make sure the subscription is still active. Disabled or past due subscriptions produce errors that look a lot like permission failures, and the Overview page will tell you immediately.

If none of those apply and it really is just a missing role assignment, then the steps above are correct and elevating access is the way back in. Switch it off again once you’ve assigned yourself Owner, it’s meant to be temporary.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.