Azure access issue

Ask the Azure subscription administrator to assign your account an Azure RBAC role at the required subscription, resource-group, or resource scope; the Microsoft 365 Education A3 license does not itself authorize access to Azure resources.

Azure resource access is controlled by Azure role-based access control (RBAC), separately from Microsoft 365 licensing and Microsoft Entra administrator roles.^1^

1. Have an administrator compare your access with your friend’s

An administrator who can read role assignments should:

1. Open Azure portal → Subscriptions.
2. Select the subscription containing the resources.
3. Open Access control (IAM) → Check access → Check access.
4. Select User, group, or service principal.
5. Search for your account and review:
   • Direct role assignments
   • Roles inherited from groups or parent scopes
   • Deny assignments
6. Repeat the check for your friend and compare the role, scope, and group membership.

The Check access pane shows assignments at the selected scope and inherited from parent scopes; assignments made only at child scopes are not displayed there.^2^

2. Assign the required Azure role

If your account has no suitable role, an administrator with Microsoft.Authorization/roleAssignments/write, such as Role Based Access Control Administrator or User Access Administrator, should:

1. Open the required subscription, resource group, or individual resource.
2. Select Access control (IAM).
3. Select Add → Add role assignment.
4. Choose the least-privileged role needed:
   • Reader — view resources only.
   • Contributor — create and manage resources, but not role assignments.
   • A service-specific role — if access should be limited to one Azure service.
5. Under Members, select User, group, or service principal.
6. Select your account, then choose Review + assign.^3^

Prefer assigning the role to an appropriate security group if access is managed by department or job function. The scope should be as narrow as practical: assigning at subscription scope applies broadly, while resource-group or resource scope limits access.^4^

3. If the role is already assigned, check the portal context

Because your friend can access the resources, verify that both accounts are viewing the same directory and subscription:

1. In the Azure portal, open Portal settings → Directories + subscriptions.
2. Confirm Current directory matches the tenant containing the subscription.
3. If not, find the correct directory and select Switch.
4. Under the subscription filter, use the Default filter or select all relevant subscriptions.

A subscription filter can hide subscriptions across portal views even when the user has access.^5^

Also confirm that you signed in with the intended work or school account, especially if a personal Microsoft account uses the same email address.

Expected result

After the correct RBAC assignment exists at the required scope and the correct directory/subscription is selected, the subscription and permitted resources should appear. If they still do not, provide the administrator with:

• Your account’s object ID
• The subscription ID
• The affected resource or resource-group name
• The exact portal error
• Timestamp and correlation ID, if displayed

These details allow the administrator or Microsoft support to investigate the authorization result without sharing passwords or other credentials.

References

1. Azure roles, Microsoft Entra roles, and classic subscription administrator roles
2. List Azure role assignments using the Azure portal
3. Assign Azure roles using the Azure portal
4. Understand scope for Azure RBAC
5. Manage Azure portal settings and preferences