Unable to set Microsoft Entra ID Group as Administrator on Azure Database for MySQL Flexible Server – InternalServerError

Question

Unable to set Microsoft Entra ID Group as Administrator on Azure Database for MySQL Flexible Server – InternalServerError

Stefania Campanella 0

We are unable to set a Microsoft Entra ID security group as the Microsoft Entra Administrator for an Azure Database for MySQL Flexible Server.

The operation fails with the following error:

InternalServerError: An unexpected error occurred while processing the request.

The issue has been reproduced using:

Azure Portal
Azure CLI 2.90.0
Azure CLI 2.77.0

The server currently has a valid Microsoft Entra Administrator configured as an individual user. The issue occurs when attempting to replace this administrator with a Microsoft Entra ID security group.

The User Assigned Managed Identity configured for the MySQL server has the required Microsoft Graph application permissions with Admin Consent.

Since the same InternalServerError occurs through both the Azure Portal and different Azure CLI versions,we would like to investigate the server-side operation and associated backend telemetry.

0 comments

2 answers

Your answer

Answer 1

Maksood Ahmed 15 Microsoft External Staff Moderator

Hi Stefania,

Since the individual Entra administrator is working, I would first recheck the user-assigned managed identity configured for the MySQL Flexible Server.

For group-based Entra administration, Microsoft documents that the managed identity requires User.Read.All, GroupMember.Read.All, and Application.Read.All permissions. Alternatively, the managed identity can have the Directory Readers role. Microsoft also supports selecting an Entra group as the administrator.

If these permissions are already configured correctly and the same InternalServerError continues from both the portal and CLI, collect the failed operation/correlation details and open an Azure support request for further investigation.

FYR:

Set up Microsoft Entra authentication for Azure Database for MySQL Flexible Server

Maksood Ahmed 15 Reputation points Microsoft External Staff Moderator

2026-10-02T13:33:15.1166667+00:00

Hi Stefania,

Just following up to check whether you were able to verify the required permissions for the user-assigned managed identity.

If the permissions are already configured correctly and you are still receiving the same InternalServerError, please let us know so we can advise on the next steps.

Answer 2

Hi Stefania,

Azure Database for MySQL Flexible Server does support using a Microsoft Entra security group as the Entra administrator. Microsoft also documents the required managed identity permissions: User.Read.All, GroupMember.Read.All, and Application.Read.All, or the Directory Readers role.

Since you are getting the same InternalServerError from the portal and multiple Azure CLI versions, and an individual Entra administrator is already working, this looks more like a service-side issue than a CLI or configuration problem.

I would open an Azure Support case and provide the MySQL server name, region, group object ID, managed identity details, exact timestamp, and the full error/correlation ID. Ask the MySQL engineering team to check the backend operation for setting the Entra group administrator.

There is no need to remove the current working administrator first. The documented CLI command supports creating/replacing the Entra administrator directly.