i'm the only user in my org azure account, but i am a member. i am shown as owner of subscription. but i'm not global admin. i cant add any internal users. how to fix?

Question

i'm the only user in my org azure account, but i am a member. i am shown as owner of subscription. but i'm not global admin. i cant add any internal users. how to fix?

dean koch 0

Shubham Sharma 3,830 Reputation points Microsoft External Staff Moderator

2025-12-04T13:30:41.23+00:00
Hello dean koch

Thank you for reaching out to Microsoft Q&A.

Why this happens: -

Azure RBAC roles (Owner, Contributor) apply to resources in a subscription.

Microsoft Entra ID roles (Global Administrator, User Administrator) apply to directory-level tasks like creating users or assigning roles.

Being a Subscription Owner ≠ Global Administrator. That’s why the new user button is greyed out.

Below are the resolution steps: -

Elevate Access and Assign Global Administrator

If you are the only admin and locked out of directory-level permissions:

Sign in to Azure Portal with your subscription Owner account.

Go to: Microsoft Entra ID → Properties → Access management for Azure resources Toggle Yes to elevate access. This gives you User Access Administrator at root scope temporarily.

Sign out and sign back in.

Navigate to: Microsoft Entra ID → Roles & administrators → Global Administrator → Assign yourself the Global Administrator role.

After assigning, you can create users under: Microsoft Entra ID → Users → + New user.

Microsoft Docs for your references:

https://v4.hkg1.meaqua.org/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs

https://v4.hkg1.meaqua.org/en-us/entra/fundamentals/how-to-create-delete-users

Please let us know if you need any further assistance.

Thanks
dean koch 0 Reputation points

2025-12-04T17:44:45.3833333+00:00

This is still an issue.

When I attempt this step: Go to: Microsoft Entra ID → Properties → Access management for Azure resources Toggle Yes

The Toggle is set at "no", and the toggle is grayed out, so I cannot toggle to yes.

Does this mean something more basic?
Shubham Sharma 3,830 Reputation points Microsoft External Staff Moderator

2025-12-05T13:27:22.7566667+00:00
dean koch

Thank you for the reply.

To resolve this, we need to engage the Data Protection team via a support ticket to unblock your access.

To proceed, I will need a few details from you. As this information contains Personally Identifiable Information (PII), please share the following details via private message only:

Contact phone number (add +Country code)

Contact email address

Global admin email address (affected account)

Tenant Name

Country

Time Zone

Tenant id/ Domain Name

Subscription id

Please send me the detail via private message. So, we can assist you further.

1 answer

Your answer

Shubham Sharma 3,830 Reputation points Microsoft External Staff Moderator

2025-12-04T13:30:41.23+00:00

Hello dean koch

Thank you for reaching out to Microsoft Q&A.

Why this happens: -

Azure RBAC roles (Owner, Contributor) apply to resources in a subscription.

Microsoft Entra ID roles (Global Administrator, User Administrator) apply to directory-level tasks like creating users or assigning roles.

Being a Subscription Owner ≠ Global Administrator. That’s why the new user button is greyed out.

Below are the resolution steps: -

Elevate Access and Assign Global Administrator

If you are the only admin and locked out of directory-level permissions:

Sign in to Azure Portal with your subscription Owner account.

Go to: Microsoft Entra ID → Properties → Access management for Azure resources Toggle Yes to elevate access. This gives you User Access Administrator at root scope temporarily.

Sign out and sign back in.

Navigate to: Microsoft Entra ID → Roles & administrators → Global Administrator → Assign yourself the Global Administrator role.

After assigning, you can create users under: Microsoft Entra ID → Users → + New user.

Microsoft Docs for your references:

https://v4.hkg1.meaqua.org/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs

https://v4.hkg1.meaqua.org/en-us/entra/fundamentals/how-to-create-delete-users

Please let us know if you need any further assistance.

Thanks
dean koch 0 Reputation points

2025-12-04T17:44:45.3833333+00:00

This is still an issue.

When I attempt this step: Go to: Microsoft Entra ID → Properties → Access management for Azure resources Toggle Yes

The Toggle is set at "no", and the toggle is grayed out, so I cannot toggle to yes.

Does this mean something more basic?
Shubham Sharma 3,830 Reputation points Microsoft External Staff Moderator

2025-12-05T13:27:22.7566667+00:00

dean koch

Thank you for the reply.

To resolve this, we need to engage the Data Protection team via a support ticket to unblock your access.

To proceed, I will need a few details from you. As this information contains Personally Identifiable Information (PII), please share the following details via private message only:

Contact phone number (add +Country code)

Contact email address

Global admin email address (affected account)

Tenant Name

Country

Time Zone

Tenant id/ Domain Name

Subscription id

Please send me the detail via private message. So, we can assist you further.

Answer 1

Hello dean koch

The issue pertains to a tenant lockout, where no other global admin in the tenant has the necessary permissions to re-register MFA.

To resolve this, we have engaged our Data Protection team through a support ticket. They will reach out to you via email or phone to help restore access to the tenant and assist in resolving the issue.

Once the issue has been resolved by our support team, please feel free to revisit and kindly click Accept the Answer and upvote it 👍 as this will be helpful to other community members facing similar issues.

Share via

i'm the only user in my org azure account, but i am a member. i am shown as owner of subscription. but i'm not global admin. i cant add any internal users. how to fix?

1 answer

Your answer