Urgent Issue with Role Assignment in Azure – "MissingSubscription" Error

Hello,

Thank you for your response. However, I have already tried all the steps mentioned, and the issue persists. Here’s what I have done so far:

1.Verified that I am logged in:

         az login

        az account set --subscription <subscription-id>

        az account show --output table

• My subscription is active and set as default.

2.Checked role assignments:

        az role assignment list --assignee $(az ad signed-in-user show --query id -o tsv) --output table

·         My user account has Owner and User Access Administrator roles.

·         I also tried assigning the AcrPull role to a Service Principal via CLI, but I still get the same MissingSubscription error.

3.Manually assigned the role via Azure Portal:

·         I assigned the AcrPull role manually to the Service Principal via Azure Portal.

·         Waited for approximately 1.5 hours, but the issue persists.

4.Tried re-authenticating & debugging:

·         Logged out and back in using az logout && az login.

·         Ran the command with --debug but didn't find anything unusual.

·         Used az login --identity but still facing the same issue.

5.Manually created a Kubernetes Secret for ACR authentication:

    kubectl create secret docker-registry acr-secret \

      --docker-server=<acr-name>.azurecr.io \

      --docker-username=<acr-username> \

      --docker-password=<acr-password>

Even after this, I cannot pull images from ACR.

Questions:

• Could this be a Tenant-level restriction issue preventing role assignments?
• Is there a known RBAC delay that might be causing this?
• How can I troubleshoot this further to identify the root cause?

Any insights from Microsoft support would be highly appreciated.

Thanks!

Hi nehad shmale,

Just checking in to see if you had a chance to review the comment on your question. Please let us know if it was helpful and feel free to reach out if you have any further queries. If you found the information useful, please click "Upvote" on the post to let us know.

 Thank You.

Hi nehad shmale,

1. Verify Tenant-Level Restrictions

Since the “MissingSubscription” error persists even with correct role assignments, it’s possible that Tenant Restrictions or Azure Policies are preventing role assignments.

Check Azure Policies:

Run the following command to see if any policies might be blocking role assignments:

az policy assignment list --output table

If a policy is preventing role assignments, it should appear here.

Check Tenant-Wide Subscription Access:

az account list --output table

If the subscription does not appear, the account might not have access at the tenant level.

Confirm Role Assignments at the Tenant Level:

Try explicitly assigning the AcrPull role at the tenant scope:

az role assignment create --assignee <service-principal-id> --role AcrPull --scope /providers/Microsoft.Management/managementGroups/<management-group-id>

If the command fails, there may be Tenant-Level RBAC restrictions in place.

2. Confirm Subscription Ownership & RBAC Permissions

Even though the user has Owner and User Access Administrator roles, there may be Conflicting RBAC Settings at a higher level (Management Groups or Tenant Level).

Check If Subscription is Linked to the Tenant:

az role assignment list --all --assignee <service-principal-id> --output table

Ensure that AcrPull is listed with the correct scope.

Explicitly Assign Subscription Access:

Try explicitly assigning the role at the subscription level instead of the ACR level:

az role assignment create --assignee <service-principal-id> --role AcrPull --scope /subscriptions/<subscription-id>

If this works, there may be a role inheritance issue with the ACR resource.

3. Confirm ACR Authentication & Firewall Settings

If the role assignment looks correct but image pull still fails, check if network security rules or firewalls are blocking the service principal.

Check ACR Firewall Restrictions:

az acr show --name <registry-name> --query "networkRuleSet"

If allowAzureServices is false, enable it:

az acr update --name <registry-name> --public-network-enabled true

Enable Diagnostics to Capture Logs:

az monitor diagnostic-settings create \
  --name "ACRDiagnostics" \
  --resource /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ContainerRegistry/registries/<registry-name> \
  --logs '[{"category": "ContainerRegistryLoginEvents", "enabled": true}]'

Collect debug logs

az role assignment create --assignee <service-principal-id> --role AcrPull --scope /subscriptions/<subscription-id> --debug > debug.log

Please provide Error Details & Subscription ID.

Request an Investigation for Potential Tenant-Level Restrictions.

If you found the information useful, please click "Upvote" on the post to let us know.

Hi nehad shmale,

Just checking in to see if you had a chance to review the comment on your question for previous response. Feel free to reach out if you have any further queries.

If you found the information helpful, please click "Upvote" on the post to let us know.

 Thank You.