Microsoft Azure error

Hi Charles Irakiza,

Thanks for posting your question in Microsoft Q&A forum

This is mostly caused by insufficient permissions or role assignments in your Azure Active Directory (AAD) or subscription. Specifically,

• You need to have appropriate Azure AD roles such as Global Administrator, User Administrator or at least the Owner or User Access Administrator role on the subscription or resource scope to manage members. Without these, the options will be disabled even if you have some administrative roles.​

If you are the subscription owner but cannot add/remove members, it might be due to not having the Azure AD roles needed (e.g., Global Administrator is an AAD role distinct from subscription Owner role). You may need to request elevation to a User Administrator or Global Admin role in AAD to perform user and member management tasks.​

Conditional access policies or restrictions on the tenant or subscription might also disable these functions. Checking such policies or role assignments in Access control (IAM) in the portal is recommended.​

• To resolve this, confirm the roles you have assigned in Azure AD and the subscription, and if needed, ask a Global Administrator to assign you the necessary roles such as User Administrator or Global Administrator. You may be able to view your current roles under Azure AD > Users > Your profile > Assigned roles.

You should be able to add members and owners to the groups you've created both during and after their creation. However, in the Azure portal, you can add members and owners only during the group creation process, not after. If you have the Group Administrator role assigned to your account, you'll be able to manage all aspects of any group in your tenant via the Azure portal.

If you prefer not to assign the Group Administrator role but still want to add members or owners to the groups you've created, you can use following option

Using PowerShell:

• Add-AzureADGroupMember -ObjectId "object_id_of_group" -RefObjectId "object_id_of_member_to_add"
• Add-AzureADGroupOwner -ObjectId "object_id_of_group" -RefObjectId "object_id_of_owner_to_add"

I hope the provided answer is helpful, do let me know if you have any further questions on this Please accept as Yes & upvote if the answer is helpful so that it can help others in the community.

This usually happens when your account doesn’t actually have the right directory-level role, even if you are an Owner on the subscription.

Adding or removing members is controlled by Entra ID roles, not Azure RBAC.

The first thing to check is whether your account is a Global Admin or User Administrator in Entra ID. If you only have subscription roles (Owner, Contributor, etc.), the Add/Remove member buttons will stay greyed out.

Something else that can cause this is the “Restricted management” setting or if your account was assigned the role through PIM and the role is not activated.

So the fix is:

1. Go to Entra ID --> Roles and administrators.

Make sure your account has Global Administrator or User Administrator.

If using PIM, activate the role first.

Refresh the portal and try again.

Once the correct directory role is active, the buttons will no longer be disabled.