-
Notifications
You must be signed in to change notification settings - Fork 3.4k
az account management-group <cmd> fails #21949
Copy link
Copy link
Open
Labels
ARMaz resource/group/lock/tag/deployment/policy/managementapp/account management-groupaz resource/group/lock/tag/deployment/policy/managementapp/account management-groupAccountaz login/accountaz login/accountAuto-AssignAuto assign by botAuto assign by botact-identity-squadcustomer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.feature-request
Milestone
Metadata
Metadata
Assignees
Labels
ARMaz resource/group/lock/tag/deployment/policy/managementapp/account management-groupaz resource/group/lock/tag/deployment/policy/managementapp/account management-groupAccountaz login/accountaz login/accountAuto-AssignAuto assign by botAuto assign by botact-identity-squadcustomer-reportedIssues that are reported by GitHub users external to the Azure organization.Issues that are reported by GitHub users external to the Azure organization.feature-request
Describe the bug
az account management-group <cmd>fails when logged in with a service principal which does not have any role assignments to any subscriptions.The
az loginis done with the--allow-no-subscriptionsflag.When
az account management-group create/delete/show/listis run, it throws the following errorError
The SubscriptionId mentioned in the error is the tenantId which was passed during
az loginThe Service principal has Contributor access to the Management Group.
A bicep template to create MG works fine when deployed with the same Service principal credentials
To Reproduce
az ad sp create-for-rbac --name "mg-sp"Note: The SP should not have any role assignments to any subscriptionsaz login --service-principal -u xxx -p xxx -t 'tenant-id-xxx' --allow-no-subscriptionsaz account management-group show --name <mg-id>Expected behavior
az account management-group <cmd>runs even if there are no role assignments to subscriptionsEnvironment summary
Additional context