Azure AD受邀用户已获全部管理员权限仍无法创建订阅求助

Hey there, let’s figure out why your newly created Azure AD user can’t create subscriptions—even with all admin roles assigned. The key here is understanding that Azure AD roles and billing/subscription permissions are separate systems. Here’s what’s going on and how to fix it:

Azure AD admin roles (like Global Administrator) grant control over identity and directory resources, but they don’t automatically give access to manage billing accounts or create subscriptions. Subscription creation is governed by permissions tied directly to your billing account (whether it’s a Microsoft Customer Agreement, Enterprise Agreement, or Pay-As-You-Go plan).

• Assign a billing account role to the user
  You need to grant the user a role on your billing account that explicitly allows subscription creation. The most relevant roles are:

  • Billing Account Owner: Full access to manage the billing account and create subscriptions
  • Billing Account Contributor: Can create subscriptions and manage billing resources
  • Subscription Creator: A specialized role that only allows creating new subscriptions under a specific billing profile

• How to add the billing role

  1. Sign in to the Azure portal using an account that already has billing account owner permissions.
  2. Navigate to Cost Management + Billing and select your billing account from the list.
  3. Go to Access control (IAM) in the left-hand menu.
  4. Click Add > Add role assignment.
  5. Search for and select the appropriate billing role (e.g., Billing Account Owner), then find and select your new user.
  6. Save the role assignment.

• Wait for permissions to propagate
  It can take a few minutes for the new permissions to kick in. Have the user sign out of the Azure portal completely, then sign back in. They should now have the ability to create a new subscription.

• Enterprise Agreement (EA) accounts: If you’re on an EA, you’ll need to add the user as an EA Account Owner or EA Department Administrator in the EA portal (not just Azure AD) to let them create subscriptions.
• Pay-As-You-Go linked to a Microsoft account: Only the original account owner can create subscriptions here. You’ll need to transfer billing ownership or add the user as a co-administrator on the billing account.

内容的提问来源于stack exchange，提问作者Almis