Request for Permission to List All Subscriptions Under Root Management Group

Use the built-in Azure RBAC role is Management Group Reader. This role provides read-only access to management group information and the hierarchy beneath it, including the subscriptions contained within that hierarchy. It does not grant permissions to create, modify, or delete subscriptions, resources, or management group configuration.

The role should be assigned at the Root Management Group scope:

/providers/Microsoft.Management/managementGroups/<root-management-group-id>

The assignment then flows down through the management group hierarchy, allowing the service principal to discover and read the subscriptions underneath the root management group.

Note that there a distinction between Management Group Reader and the broader Reader role. Management Group Reader is the better least-privilege choice when the service principal's requirement is limited to reading the management group hierarchy and discovering/listing subscriptions. The general Reader role grants substantially broader read access, including read access to Azure resources within the scope, so it is unnecessary if the application does not need to inspect resources.

If the application needs to do more than enumerate subscriptions, such as retrieve resource groups, virtual machines, storage accounts, or other resources within those subscriptions, then Reader at the Root Management Group scope would be appropriate instead. But for the stated requirement of listing/retrieving the subscriptions under the Root Management Group, use Management Group Reader at the Root Management Group scope.

More at https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#management-group-reader

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin