Azure Active Directory Permission issue for User to be added to Azure Subscription

Question

Hi I am seeing this issue with Azure Subscriptions, I am trying to assign other users using (IAM) (RBAC) to Azure Subscription

The Owner of the Azure Subscription is a member of the Azure AAD but not a admin however they are an owner of an Azure Subscription

They wish to add other member of the Orgs AAD to their Azure subscription using RBAC they go into the Azure Subscription and go Access Control (IAM) blade they click the add +

Choose the role which is required, Owner, contributor, select assign access to - using Azure AD user, group or service principal

Enter the email or name of the user

However the issue their is an error displayed

An error occurred when returning search results, try again

I believe this is an issue with the permission of Azure Subscription owner within AAD (who is only a user within the AAD)

Can anyone confirm what permissions does this user need setting by the AAD admin to be able to lookup and add AAD users to the Azure Subscription?

Answer 1

First, the default member has the permission to do such operation, I also have done that many times.

Reference : Compare member and guest default permissions

I suppose your tenant may set Ability to read other users to $False, I can reproduce your issue with that, try to let your admin to use the powershell Set-MsolCompanySettings -UsersPermissionToReadOtherUsersEnabled $True, then it should work.

Or you can let the admin assign the User administrator/Application administrator/Global administrator(maybe other roles also work, I just test for the three roles) to your account in the Azure AD -> Roles and administrators in the portal, no need to Set-MsolCompanySettings, then your account will not be affected by the setting, it will also work fine.

Reference : To restrict the default permissions for member users