Azure Policy
An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
I think I have the same issue.. any fix? Is there a bug?
how to fix You do not have permissions to create resource groups under subscription
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 11%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJW%3C/text%3E%3C/svg%3E)
Jeffrey Wilds
25
Reputation points
You do not have permission to create resource groups under subscription
Azure Policy
Answer accepted by question author
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 77%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAC%3C/text%3E%3C/svg%3E)
Adrian Chirtoc
126
Reputation points
-
Jeffrey Wilds 25 Reputation points
2024-03-20T17:47:17.2+00:00 I removed the secondary user with the Classic Administrator Role enabled, and now logging in and creating resources with the user the subscription was established with.
I have not had time to create a secondary user and assign an admin role through RBAC and test.
Sign in to comment
6 additional answers
Sort by: Most helpful
-
Jeffrey Wilds 25 Reputation points
2024-03-15T17:38:45.7666667+00:00 I did until yesterday. I wonder if this has anything to do with this (see below):
Transition to role-based access control (RBAC) in Azure by 31 August 2024
You're receiving this notice because you use Azure classic administrator roles.
On 31 August 2024, Azure classic administrator roles will be retired. If your organization has active Co-Administrator or Service Admin roles, you'll need to transition to using Azure RBAC roles by then. (All Azure classic resources and Azure Service Manager will also be retired on that date.)
You may continue using these Azure classic admin roles until they're retired. However, starting 3 April 2024, you'll no longer be able to add new Co-Administrator roles through the Azure portal.
-
-
Sadiqh Ahmed 49,571 Reputation points Microsoft External Staff Moderator2024-03-15T18:52:15.36+00:00 @Jeffrey Wilds That's great to hear! :)
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 42%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBW%3C/text%3E%3C/svg%3E)
Ben Watt 0 Reputation points2024-03-16T08:19:03.84+00:00 How did you resolve? I am getting the same and am full tenant admin
-
Jeffrey Wilds 25 Reputation points
2024-03-16T09:51:33.8366667+00:00 My issue was a little different, I had an additional user assigned the Classic Administrator role and it just stopped working. I resolved the issue by using the user the tenant was established with. The Classic Administrator role is being retired soon and after March 26 cannot be added anymore. It will be retired August 31 and RBAC must be used. All of these settings are in Subscriptions -> Access Control (IAM).
Sign in to comment -
-
Jeffrey Wilds 25 Reputation points
2024-03-15T17:35:23.08+00:00 That was the only tag available that was close to my situation.
-
Jeffrey Wilds 25 Reputation points
2024-03-15T17:32:42.1433333+00:00 IAM at the subscription level settings are as follows:
Current Role Assignments -> Classic Administrator -> Service Administrator ->
Has full access to all resources in the subscription.
I am still unable to create a resource group to deploy Azure resources in.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 32%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Michael Taylor 61,221 Reputation points2024-03-15T18:07:03.36+00:00 Please use
Add commentto respond to answers so that your comments group with the answer you're replying to.To create a resource group you must either be a contributor or the owner of the subscription. The classic Service Administrator should have the Owner privileges. You can check in the Azure Portal to see what your current access level is.
The deprecation is happening in Aug and until that time you should still be able to use the classic roles. However you will be forcefully migrated I believe after that point.
Sign in to comment -
-
Michael Taylor 61,221 Reputation points
2024-03-15T14:35:53.5533333+00:00 Please provide more information about your situation. The error itself indicates you do not have the necessary permissions in Azure for your subscription to create resource groups. Someone with admin rights in your subscription would need to grant you permissions to create resource groups as discussed here.
You used a tag of Azure Resource Mover which leads me to believe that there is more to your situation then just a simple permissions issue but without further details we'd only be guessing.