From bash unable to create a role assignment for an Service Principal scoped to management group

[jeevanions]

When the same command from the terminal using the same login account, runs without error. If I use the same command in a bash script, then I get this error message. The Document reference doesn't include an example for role assignment for a management group. Could we add an example here please?

Any clue why this is failing?

Command Run: az role assignment create --assignee-object-id $sp_id --assignee-principal-type "ServicePrincipal" --role "Owner" --scope $mgmt_id
Error Message : The request did not have a subscription or a valid tenant level resource provider.

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: 9dacfad8-cb2f-2534-3b29-89b0930a2252
• Version Independent ID: 17325cd4-44c5-4069-d9f6-940a55f0f7c9
• Content: az role assignment
• Content Source: latest/docs-ref-autogen/role/assignment.yml
• Service: azure-resource-manager
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[yonzhan]

@jiasli for awareness

[bebound]

Are you using the same account as terminal in bash script? This might be a permission error.
What's the format of scope?
Could you show me the output of failed command with --debug parameter?

[jeevanions]

This role assignment doesnt need an active subscription in the context so not sure why the error here.

The format of the scope is /providers/Microsoft.Management/managementGroups/<mgmt name>

Note that this works on a terminal directly but the same command is run part of the bash script that's when we get this error.

[bebound]

I see. I doubt some argument not correctly passed to cli because of the special character. I suggest that you add --debug in the end of the command, then you can see the params received by azure-cli in the first line. For example cli.knack.cli: Command arguments: ['kk', '--debug']

[jiasli]

#25044 repots a similar error: The request did not have a subscription or a valid tenant level resource provider.. The root cause in #25044 in that the --scope is misspelled.