I have an Azure account with a user "rmuser" that I've created specifically for automated shutdowns of VMs. That user's password expired so VMs stopped being shut down. I've manually changed the password so the account accepts logins again. I found this and started working through it.

In that process, instead of Select-AzureSubscription, which I couldn't get to accept the subscription ID, I used Add-AzureAccount after which Get-AzureSubscription showed I was working with the correct subscription. I had to provide the credentials for my own account since that's what the subscription is under, however I can't use this account for 'Connect-MsolService' because it's one created elsewhere, and though I don't understand it I'm aware the account is treated differently from one created in Azure.

To get the credential for 'Connect-MsolService' I gave the rmuser account name and password when prompted by Get-Credential and got no error when doing Connect-MsolService. So I'm in the right AD, and that user has the Global Administrator role. However, if I call Set-MsolUser I get an error Set-msoluser : Access Denied. You do not have permissions to call this cmdlet.

I'm running Powershell explicitly as administrator. I've read that the error can be caused by the specified username not being found so I've confirmed with Get-MSOLUser that the user is found. I've also tried just changing the Department field in case there's an issue specifically with the PasswordNeverExpires field. I've read elsewhere that execution policy may be an issue, so I've set that to unrestricted. I'm somewhat stumped as to what to do next. Does anyone know what's going on and where to go from here?

  • Execute Set-Msoluser you need Global Administrator directory role. You had better check again on Azure Portal. – Shui shengbao Sep 28 '17 at 5:11

According to your description, I test in my lab, I get same error log if my Azure AD user does not have Global administrator directory role.

enter image description here

You could check the permission on new Azure Portal. Find it Azure Active Directory-->Users and Groups-->All Users-->Your User-->Directory role.

enter image description here

  • Hi, does it work now? You also could reset password on new Azure Portal. – Shui shengbao Sep 28 '17 at 9:47
  • Thanks for replying. I did check several times before posting to make sure rmuser really is a global admin. I've just checked again and indeed it is. Granted that error gives the same symptoms but appears not to be the cause in this case. – Craig Graham Oct 3 '17 at 10:42
  • Do you use the account to login Azure? – Shui shengbao Oct 3 '17 at 11:26
  • No, the subscription is under an account that was created as an XBox Live account. A tutorial I followed some time back advised the creation of a new administrator account for the purpose, from the Active Directory tab of the primary account. This new account allows login to Azure but the dashboard doesn't load, showing the error "We could not load the dashboard named 'private/acbc0125-aa0a-4068-b6ea-a659f605100d'. Refresh the portal to try again." and a popup appears saying "You do not have any Azure subscriptions in the craigshouse.net directory. Click here to switch to another directory." – Craig Graham Oct 3 '17 at 12:15
  • The user that you login Azure needs Gloabl adminstration permission. It seems your xbox account does not have the permission. – Shui shengbao Oct 3 '17 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.