App Registration

Hi Krzysztof Raczka

I think, the Reader role is missing for reading the list

Assign a Reader role to application at the scope of Subscription Level using the following command

az role assignment create --assignee <APP_ID> --role "Reader" --scope /subscriptions/<SUBSCRIPTION_ID>  

After that, check if the issues is resolved

az role assignment list --assignee <Application-id or Object-Id of application>

Hope this helps.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Hi Krzysztof Raczka,

Thank you for posting your query on Microsoft Q&A.

As per our understanding, you have created an App Registration and assigned access to various Azure resources for its service principal. However, when you check the roles assigned to the app registration, it shows no roles, and the app is not authorized to access the resources.

This happens because Azure RBAC roles are assigned to the service principal, not the app registration itself. If the service principal does not exist or you are using the wrong ID (application object ID instead of service principal ID), you will see an empty roles list.

In additional to Manu Philip, please check if the below information is helpful to fix the issue.

Please refer to:

Register a Microsoft Entra app and create a service principal

Assign Azure roles using the Azure portal

To fix this issue, please follow these steps:

1. Check if the Service Principal exists
   • In Azure Portal, go to Azure Active Directory > Enterprise Applications.
     • Search for your app registration name. If not found, the service principal does not exist yet.
     1. Create the Service Principal if missing
        • Use Azure CLI to create it:

az ad sp create --id <ApplicationId>

1. Assign the required role to the Service Principal
   • Via Azure Portal: Go to the resource or subscription > Access control (IAM) > Add role assignment.
     • Select the role (e.g., Reader), choose User, group, or service principal, and select your app’s service principal.

Azure CLI:
az role assignment create --assignee <ServicePrincipalId> --role Reader --scope /subscriptions/<subscriptionId>

1. Verify the role assignments

Azure CLI: az role assignment list --assignee <ServicePrincipalId>

Assigning roles to the correct service principal and verifying its existence will resolve the authorization issues.

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.