Subscription Owner cannot assign Artifact Signing Identity Verifier

An explicit Reader assignment should not be necessary because subscription-scope Owner already grants full resource access and role-assignment capability; instead, inspect the failed Microsoft.Authorization/roleAssignments/write operation and verify that the selected guest object belongs to the subscription’s tenant.

Artifact Signing requires the verifier to have at least Reader-level access at subscription scope and a separate Artifact Signing Identity Verifier assignment on the signing account. Owner does not grant identity-validation capability itself, but it exceeds Reader’s resource permissions and permits Azure RBAC assignments.^1^^2^

Find the portal’s underlying error

1. In the Azure portal, open Subscriptions → your subscription → Activity log.
2. Set:
   • Event category: Administrative
   • Operation: Create role assignment
   • Timespan: include the failed attempt
3. Open the failed event and select JSON.
4. Record and inspect:
   • authorization.action — should be Microsoft.Authorization/roleAssignments/write
   • authorization.scope
   • caller
   • status.value
   • properties.statusCode
   • properties.statusMessage
   • correlationId
   • The request body’s principalId and roleDefinitionId

Azure records role-assignment creation attempts in the Activity Log, and its JSON view provides the detailed failure hidden by the portal notification.^3^

PowerShell can also locate recent RBAC operations:

Get-AzLog -StartTime (Get-Date).AddDays(-1) |
  Where-Object {
    $_.Authorization.Action -eq
      "Microsoft.Authorization/roleAssignments/write"
  } |
  Format-List Caller, EventTimestamp, Status,
    CorrelationId, Properties

Interpret the result

• AuthorizationFailed or missing roleAssignments/write:
  Check Subscription → Access control (IAM) → Check access for the currently signed-in guest identity. Owner normally contains the required permission. If the assignment is eligible through Privileged Identity Management, it must be active; after recently activating or granting access, refresh the sign-in credentials. Azure RBAC also documents Role Based Access Control Administrator as a role that can perform this operation.^4^
• An ABAC/assignment-condition message:
  Open Check access and inspect the role assignment that grants Owner or access administration. A condition can restrict which roles or principals may be assigned even when roleAssignments/write is present.^4^
• PrincipalNotFound, tenant mismatch, or an unexpected principalId:
  The role assignment targeted the wrong directory object, or the guest object has not replicated. A guest has a distinct object in the resource tenant; the assignment must target that object rather than the user object from the home tenant. In the portal:
  1. Use the directory selector to switch to the tenant containing the subscription.
  2. Open Microsoft Entra ID → Users and locate the guest.
  3. Confirm the guest invitation has been redeemed.
  4. Note that guest object’s Object ID.
  5. Repeat Artifact Signing account → Access control (IAM) → Add → Add role assignment, selecting that existing guest object.
  External users can receive Azure roles, but they must exist in the resource directory and complete the invitation process.^5^

Retry the supported assignment path

Artifact Signing documents this role as portal-only:

1. Open the Artifact Signing account.
2. Select Access control (IAM) → Roles and confirm Artifact Signing Identity Verifier is listed.
3. Select Add → Add role assignment.
4. Choose Artifact Signing Identity Verifier.
5. Select the guest object from the subscription’s tenant.
6. Select Review + assign twice.
7. Confirm it appears under Role assignments, including inherited assignments if applicable.^1^

Do not substitute Owner for this custom role: Owner can manage the account and its role assignments, but only Artifact Signing Identity Verifier can manage identity validation.^6^

If the Activity Log shows that Azure accepted the request but the assignment still never appears, open an Azure support request for Azure → Security → Azure Artifact Signing and include the timestamp, correlation ID, subscription and resource IDs, guest object ID, region, and Activity Log JSON. Artifact Signing’s FAQ identifies an Azure portal support ticket as the supported escalation path.^7^

References

1. Tutorial: Assign roles in Artifact Signing
2. Azure built-in roles for Privileged
3. View activity logs for Azure RBAC changes
4. Troubleshoot Azure RBAC
5. Assign Azure roles to external users using the Azure portal
6. Artifact Signing resources and roles
7. Artifact Signing FAQ