Granting yourself access to Azure subscriptions in Entra ID as a Global Administrator

Being a Global Administrator in Entra ID (formerly Azure AD) gives you broad control over the directory, but it does not automatically grant you access to Azure subscriptions. If you’ve just been made a Global Admin and can’t see any subscriptions in the Azure portal, or you need to give another admin access, here’s how to do it.

Why can’t I see subscriptions?

Entra ID roles and Azure subscription RBAC (Role-Based Access Control) are separate. A Global Admin has full control over the directory but needs to be explicitly assigned a role like Owner, Contributor, or Reader at the subscription or resource group level.

Step 1: Locate the subscription

1. Sign in to the Azure portal.
2. In the search bar at the top, type Subscriptions and select it.
3. If you can see the subscription listed, proceed to Step 2. If not, you may need to have someone who already has Owner rights add you first — or you can use the Tenant-level elevation feature (see below).

Step 2: Assign yourself (or another user) access

1. Click on the subscription you want to manage.
2. In the left-hand menu, click Access control (IAM).
3. Click Add at the top, then select Add role assignment.
4. Choose a role:
   • Owner — Full access to manage all resources, including the ability to assign access to others.
   • Contributor — Full access to manage resources, but cannot assign access.
   • Reader — Can view everything but cannot make changes.
5. Click Next.
6. Click + Select members, search for the user (or yourself), and select them.
7. Click Review + assign.

Tenant-level elevation (Global Admin workaround)

If you are a Global Admin but cannot see any subscriptions at all, you can use tenant-level elevation to gain access. This is typically used when you need to break-glass into a subscription where all existing Owners have left the organisation.

Warning: This grants you User Access Administrator at the root management group, which gives you the ability to assign access to any subscription. Use with care and revoke after use.

1. Open Entra ID in the Azure portal.
2. In the left-hand menu, click Properties.
3. Under Access management for Azure resources, set the toggle to Yes.
4. Wait a few minutes, then navigate back to Subscriptions — you should now see them.
5. Assign yourself Owner on the subscription using the steps above.
6. Optionally, go back and set the toggle to No once you’re done.

This elevation is documented by Microsoft here.

Summary

• Being a Global Admin does not mean you own Azure subscriptions.
• Use Access control (IAM) to assign yourself or others the appropriate RBAC role.
• If no subscriptions are visible, use tenant-level elevation as a break-glass mechanism.
• Always follow the principle of least privilege — assign the minimum role needed.