Script to Assign Permission at Tenant Root Management Group Level

Once you have created your App Registration in Entra, this script can be used to apply the Reader permission at the management group level.

Before Running the Script

1. Make sure you have the client id for your Service Principal / App Registration that you have created

2. Make sure you have elevated permissions  for Global Admin & Tenant Owner

3. Log into Azure CLI and get an Azure Resource Manager scoped token with the below command

az login --use-device-code --tenant [Tenant ID]

3. Log into Azure CLI and get a Microsoft Graph API scoped token with the below command

az login --use-device-code  --scope https://graph.microsoft.com//.default --tenant [Tenant ID]

4. Save the below full script somewhere you can run it from

5. Run the script like this

.\Setup-TenantRootManagementGroup-Permission.ps1 -ClientId <app-registration-client-id>

Script

# Assigns the Reader role to a Service Principal at the Tenant Root Management Group scope.
# This grants read access to all subscriptions and resources in the tenant.
#
# Prerequisites:
#   - PIM into Global Admin or Tenant Owner (required to assign roles at root scope)
#   az login --use-device-code --tenant [Tenant ID]
#   az login --use-device-code --scope https://graph.microsoft.com//.default --tenant [Tenant ID]
#
# Usage:
#   .\Setup-TenantRootManagementGroup-Permission.ps1 -ClientId <app-registration-client-id>

param(
    [Parameter(Mandatory = $true)]
    [string]$ClientId
)

# Look up the Service Principal Object ID
Write-Host "Looking up Service Principal for Client ID: $ClientId ..."
$SpObjectId = az ad sp show --id $ClientId --query id -o tsv

if (-not $SpObjectId) {
    Write-Error "Could not find a Service Principal for Client ID '$ClientId'. Ensure the App Registration exists and you are logged in to the correct tenant."
    exit 1
}

Write-Host "Found Service Principal Object ID: $SpObjectId"

# Get the Tenant ID to build the root management group scope
$TenantId = az account show --query tenantId -o tsv
$Scope = "/providers/Microsoft.Management/managementGroups/$TenantId"

Write-Host "Assigning 'Reader' role at Tenant Root Management Group scope: $Scope ..."

az role assignment create `
    --assignee-object-id "$SpObjectId" `
    --assignee-principal-type ServicePrincipal `
    --role "Reader" `
    --scope "$Scope"

if ($LASTEXITCODE -ne 0) {
    Write-Warning "Failed to assign Reader role. Ensure you have elevated permissions (Global Admin / root management group Owner)."
    exit 1
}

Write-Host ""
Write-Host "Successfully assigned 'Reader' role at Tenant Root Management Group."

Write-Host ""
Write-Host "Verifying assignment ..."
az role assignment list --assignee "$SpObjectId" --scope "$Scope" --output table