Azure / Azure/azure-powershell

Az-GetManagementGroup creates user error when encountering subscription in MG hierarchy that is disabled or de-registered state

Open
#25,315 2 comments 2 reactions 0 assignees View on GitHub
bug customer-reported Management Groups Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

Customer with account that has following permissions:
Tenant Root = Reader
Intermediate Root = Resource Policy Contributor, Role Based Access Control Administrator

When running command Az-GetManagmentGroup -GroupName Intermediate-Root, customer gets error

Get-AzManagementGroup: The client 'xxxxr@yyyyy.onmicrosoft.com' with object id 'xxxxxxxxx-d218-49fc-b3a0-421f69yyyyyyy' does not have authorization to perform action 'Microsoft.Management/register/action' over scope '/subscriptions/xxxxxxx8de1-4c6c-a5a3-2fe106ff2272' or the scope is invalid. If access was recently granted, please refresh your credentials.

The subscription does exist, but is in some kind of disabled state. Customer is only trying to read management groups, but the PS AZ module is clearly trying to take registration action, which it really shouldn't do in the context of reading a management group hierarchy.

FYI we believe the subscriptions in question (triggering this issue) may be a part of a platform wide deprecation effort for subscriptions identified as "Access to Azure Active Directory", which is in process of being deprecated.
(https://learn.microsoft.com/en-us/answers/questions/1657719/subscription-offer-access-to-azure-active-director)

### Issue script & Debug output

```PowerShell
Get-AzManagementGroup -GroupName VXXXXXXX
Get-AzManagementGroup: The client 'xxxxr@yyyyy.onmicrosoft.com' with object id 'xxxxxxxxx-d218-49fc-b3a0-421f69yyyyyyy' does not have authorization to perform action 'Microsoft.Management/register/action' over scope '/subscriptions/633b39b7-8de1-4c6c-a5a3-2fe106ff2272' or the scope is invalid. If access was recently granted, please refresh your credentials.
```

### Environment data

```PowerShell
$PSVersionTable

Name Value
---- -----
PSVersion 7.4.2
PSEdition Core
GitCommitId 7.4.2
OS Microsoft Windows 10.0.22631
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
PS C:\GitRepoClones\epac-issue680\epac-development> get-module Az*

ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 3.0.0 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script 7.1.0 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}
```

### Error output

```PowerShell
Get-AzManagementGroup -GroupName VisaUSA-OI
Get-AzManagementGroup: The client 'xxxxx@yyyyy.onmicrosoft.com' with object id 'xxxxxxxxx-d218-49fc-b3a0-421f69yyyyyyy' does not have authorization to perform action 'Microsoft.Management/register/action' over scope '/subscriptions/633b39b7-8de1-4c6c-a5a3-2fe106ff2272' or the scope is invalid. If access was recently granted, please refresh your credentials.
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with Get-AzManagementGroup -GroupName against a hierarchy containing a disabled or de-registered subscription, using the reported Az.Accounts 3.0.0 and Az.Resources 7.1.0 versions. Trace the cmdlet's management-group read path and verify that reading the hierarchy no longer requires Microsoft.Management/register/action on the subscription.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
cli, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.