⛔Limited Access for Global Administrators in Entra ID

 ☝As a Global Administrator in Microsoft Entra ID, you might not have access to all subscriptions and management groups in your directory. Below are methods to elevate access to all subscriptions and management groups

1- Global Administrators should consider the following scenarios for elevating access.

2- Regain access to an Azure subscription or management group when a user has lost access.

3- Grant another user or yourself access to an Azure subscription or management group.

4- See all Azure subscriptions or management groups in an organization.

5- Allow an automation app (such as an invoicing or auditing app) to access all Azure subscriptions or management groups.

Follow these steps to elevate access for a Global Administrator using the Azure portal.

1- Sign in to the Azure portal or the Microsoft Entra admin center as a Global Administrator.

2- Open Azure -> navigate to Entra ID.

3- Under Manage, select Properties.

4- Under Access management for Azure resources,

 set the toggle to Yes.

The toggle allows Global Administrators in Microsoft Entra ID to assign themselves the "User Access Administrator" role at the Azure root scope. When set to Yes, it grants permission to manage roles across all Azure subscriptions and management groups in the directory. When set to No, the role is removed, restricting access to only the resources explicitly assigned to the user.

5. Click Save to save your setting.

This setting is not a global property and applies only to the currently signed in user. You can't elevate access for all members of the Global Administrator role.

6- Sign out and sign back in to refresh your access.

You should now have access to all subscriptions and management groups in your directory. When you view the Access control (IAM) pane, you'll notice that you have been assigned the User Access Administrator role at root scope.

Remove elevated access

To remove the User Access Administrator role assignment at root scope (/), follow these steps.

1- Sign in as the same user that was used to elevate access.

2- In the navigation list, click Microsoft Entra ID and then click Properties.

3- Set the Access management for Azure resources toggle back to No. Since this is a per-user setting,

 you must be signed in as the same user as was used to elevate access.

If you try to remove the User Access Administrator role assignment on

 the Access control (IAM) pane, you'll see the following message. 

To remove the role assignment, you must set the toggle back to No 

or use Azure PowerShell, Azure CLI, or the REST API.

4. Sign out as Global Administrator.