Service Principal rights assignement through management group doesn't give proper access
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
**Describe the bug**
Assigning rights to an Service Principal through a management group doesn't work as expected. The SP is not bound to any subscription even though it has rights on the subscriptions through the mgmt group.
**To Reproduce**
Create a new SP (az sp create-for-rbac --name testsp --skip-assignement
Assign the new SP to a management group (one which have access to at least one subscription)
login using az login --service-principal ....
it will fail saying no subscription can be found. You can force using --allow-no-subscriptions but still, you can't use your SP even though it has all the rights through the management group.
**Expected behavior**
The subscription on which the mgmt group gives access should be visible to the SP. We can see the SP's rights using the portal IAM blade as expected.
It works when rights are set directly on the subscriptions instead of the mgmt group.
**Environment summary**
az cli 2.0.51
Contributor guide
Assessment
This issue has not been assessed yet.