We are looking for create a global read custom role at Root management group level

AzCoAdmCore03 1 Reputation point
2021-04-15T01:33:35.637+00:00

We are looking to create a global read custom role at Root management group level, we have elevated the access in one account but i can not see the option on the portal to create a custom role at this level.

Can you please let me know if this is possible?

Thanks

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
711 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,531 Reputation points Microsoft Employee
    2021-04-20T21:39:28.06+00:00

    @AzCoAdmCore03
    Thank you for your post and I apologize for the delayed response!

    When creating a custom role within the Azure Portal, setting assignable scope to root scope ("/") is not supported. You cannot add a management group as an assignable scope, the highest option would be subscription. For more info - Assignable scopes

    89691-image.png

    Note: If you'd like to create a custom role using PS, CLI, or REST API, and add it to the Management group level under AssignableScopes this is currently in preview.

    Create or update Azure custom roles using Azure PowerShell
    Create or update Azure custom roles using Azure CLI
    Create or update Azure custom roles using the REST API

    If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

    ----------

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

    0 comments