Azure / Azure/azure-cli

Service Principal rights assignement through management group doesn't give proper access

Open
#9,967 4 comments 2 reactions 1 assignee Assigned to @jiasli View on GitHub
Authorization-cli customer-reported Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Describe the bug**
Assigning rights to an Service Principal through a management group doesn't work as expected. The SP is not bound to any subscription even though it has rights on the subscriptions through the mgmt group.

**To Reproduce**
Create a new SP (az sp create-for-rbac --name testsp --skip-assignement
Assign the new SP to a management group (one which have access to at least one subscription)
login using az login --service-principal ....
it will fail saying no subscription can be found. You can force using --allow-no-subscriptions but still, you can't use your SP even though it has all the rights through the management group.

**Expected behavior**
The subscription on which the mgmt group gives access should be visible to the SP. We can see the SP's rights using the portal IAM blade as expected.
It works when rights are set directly on the subscriptions instead of the mgmt group.

**Environment summary**
az cli 2.0.51

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.