Azure Rest API : "Management group XYZ does not have any valid subscriptions"

Question

I received error message:

{
    "error": {
        "code": "BadRequest",
        "message": "Management group XYZ does not have any valid subscriptions. (Request ID: c6a2b5dc-f198-5365-804e-04240727f3a8)"
    }
}

(postman) when I'm trying to get any information related to Azure management group. Example above becomes from url:

https://management.azure.com/providers/Microsoft.Management/managementGroups/{{managementGroupId}}/providers/Microsoft.CostManagement/query?api-version=2022-10-01

My SPN is assigned to "Reader" and "Cost Management Reader" roles for affected management group (marked red circle on screenshot). what is the cause of the issue?

I have access to another azure environment, and there all works fine with those roles assigned.

score 0 · Answer 1 · answered May 15 '23 at 12:30

I created an Azure AD Application and granted API permissions like below:

enter image description here

I assigned Reader and Cost Management Reader role to the Azure AD Application.

I created a Management Group like below:

enter image description here

Now, I generated access token using below parameters:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
client_secret:ClientSecret
scope:https://management.azure.com/.default
grant_type:client_credentials

enter image description here

I executed the query to get any information related to Azure management group like below:

https://management.azure.com/providers/Microsoft.Management/managementGroups/xxxx/providers/Microsoft.CostManagement/query?api-version=2022-10-01

enter image description here

The error "Management group XYZ does not have any valid subscriptions" if you are passing the management group do not have valid subscription.

To resolve the issue, check the below:

It's possible that the subscriptions that were once associated to the management group have been removed.
It's possible that the subscriptions that used to belong to the management group have been transferred to another management group.
It's possible that the subscriptions linked to the management group are invalid. This might be due to number of things, like subscriptions that have expired or been cancelled, or subscriptions that have hit their spending limit.

score 0 · Accepted Answer · answered May 29 '23 at 11:04

Here is the MS explanation of my problem : https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/understand-work-scopes#cloud-solution-provider-csp-scopes.

"Management groups in CSP scopes aren't supported by Cost Management. If you have a CSP subscription and you set the scope to a management group in cost analysis, an error similar the following one is shown:

Management group does not have any valid subscriptions"

Azure Rest API : "Management group XYZ does not have any valid subscriptions"

2 Answers2