Azure subscription owner review failed: role assignment list API error fix

TL;DR

Separate a listing failure from an access finding before you change any assignments, because the review is blind until enumeration works. Confirm the review identity can read role assignments at the subscription scope, check the authorization provider calls succeed with a single direct request, and make the job follow pagination links instead of assuming one page holds every assignment. Owners are few but management group inheritance adds entries, so a truncated list looks like a clean review while hiding the assignments that matter most.

Azure subscription owner review failed: role assignment list API error fix

Use this when

• Listing role assignments for a subscription errors or returns an incomplete owner list.
• The review works for some subscriptions and fails for others.
• Inherited assignments from management groups are missing from results.

Not for this skill when

• The list is complete and the question is whether an owner is justified. That is the review decision itself.
• Assignments cannot be changed after listing. Change operations have their own permission checks.

Steps

1. Run one direct role assignment list call for the subscription with the review identity and record the status and any error code or message it returns. Verify: the direct call result isolates API failure from job logic.
2. Check the review identity role at the subscription and management group scope, confirming it holds reader level access that includes role assignment read. Verify: the identity read access is confirmed at both scopes.
3. If the call succeeds, compare its total entries with the job output and check whether the job follows the continuation or next page link the API returns. Verify: any pagination gap between API total and job output is measured.
4. Include inherited assignments in the comparison by checking the flag or scope expansion the API offers, since owners often sit at management group level. Verify: inherited entries are present in the reconciled list.
5. Fix the job pagination or scope handling, rerun the enumeration, and reconcile subscription owners against the Azure portal view for the same subscription. Verify: job output and portal view agree on the owner set.
6. For subscriptions where the direct call itself fails, record the error, work the permission or subscription state cause with the subscription owner, and mark the subscription as not reviewed until it enumerates. Verify: failing subscriptions are honestly marked unreviewed with a cause.
7. File the enumeration method and per subscription counts with the review evidence so completeness is auditable. Verify: the evidence lists counts per subscription from the fixed method.
8. Alert on enumeration drift by comparing each subscription assignment count with the previous cycle count and flagging any drop larger than an agreed percentage for human review before the owner decisions begin. Verify: the comparison runs on the new enumeration and any flagged subscription carries an explanation.

Why it happens

Role assignment listing is a deceptively simple call that hides scope, inheritance and pagination behaviour. A job that reads one page from one scope will produce a plausible, wrong owner list, which is worse than an honest error. The discipline is reconciliation: API total against job output, job output against the portal, and explicit unreviewed marks for subscriptions that cannot enumerate yet. Owner reviews carry real risk decisions, so their input lists deserve that rigour.

Variants and edge cases

Azure role assignments list API returns partial results

The pagination phrasing. Follow every continuation link and prove the total before reviewing.

subscription owners missing inherited management group assignments

The inheritance phrasing. Owners granted above the subscription are invisible to a subscription only query.

review identity cannot read role assignments on some subscriptions

The permission phrasing. Reader access must exist per subscription or via the management group; there is no tenant wide default.

Edge cases to check before closing the review cycle:

• Deleted or moved subscriptions return errors that should be classified as out of scope, not retried forever.
• Classic administrator roles, where they still exist, do not appear in the same listing. Check for them separately in legacy subscriptions.
• Rate limits on large tenants slow enumeration. Page calmly with backoff rather than parallel blasting every subscription.

Compatibility: Azure role based access control role assignment listing, management group inheritance, Azure management APIs.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_stOAiw0WQf4VRmfK5WxkWA