Azure SRE Agent enrolled issue

Hello @Harikiran B S

Thank you for posting your query on Microsoft Q&A platform.

This is a known limitation when combining Azure SRE Agent with Azure Lighthouse in a multi-tenant scenario.

When you add managed resource groups or subscriptions to an Azure SRE Agent, the agent needs to create RBAC role assignments for its user-assigned managed identity (UAMI) on those resources. This operation requires Owner or User Access Administrator permissions on the target resource groups. [learn.microsoft.com]

"Contributor role on the subscription needed to register resource providers and create resources. If your team assigns managed resource groups with RBAC, you also need Owner or User Access Administrator to create role assignments."

However, Azure Lighthouse has specific role limitations:

• The Owner role is not supported at all through Lighthouse delegations.
• The User Access Administrator role is supported only for a limited purpose specifically, to assign roles to a managed identity in the customer tenant using delegatedRoleDefinitionIds.

Since the highest general-purpose role you can delegate through Lighthouse is Contributor, and Contributor lacks Microsoft.Authorization/roleAssignments/write permission, the SRE Agent enrollment fails when it tries to create the necessary role assignments on the delegated subscription. This also explains why your second subscription attempt was unsuccessful the same Lighthouse role limitation applies.

Please have a look into below workarounds:

Option 1 : Configure User Access Administrator (limited scope) in Azure Lighthouse

Azure Lighthouse does support the User Access Administrator role when scoped with delegatedRoleDefinitionIds. This allows the delegated user to assign only specific built-in roles to managed identities. You would need to update your Lighthouse ARM template to include an authorization entry like this: [techcommun...rosoft.com]

{
  "principalId": "<your-principal-id>",
  "roleDefinitionId": "18d7d88d-d35e-4fb5-a5c3-7773c20a72d9",
  "principalIdDisplayName": "SRE Agent Setup User",
  "delegatedRoleDefinitionIds": [
    "acdd72a7-3385-48ef-bd42-f606fba81ae7",
    "73c42c96-874c-492b-b04d-ab87d138a893",
    "43d0d8ad-25c7-4714-9337-8ba259a9fe05",
    "749f88d5-cbae-40b8-bcfc-e573ddc772fa"
  ]
}

These role definition IDs correspond to Reader, Log Analytics Reader, Monitoring Reader, and Monitoring Contributor the roles that the SRE Agent's managed identity needs.

Option 2 : Assign permissions directly in the customer tenant (ABC)

If updating the Lighthouse template is not feasible, have an administrator in the customer tenant (ABC) directly assign the Owner or User Access Administrator role to the user/service principal performing the SRE Agent onboarding:

1. Sign in to the Azure portal in tenant ABC directly.
2. Go to the target subscription → Access Control (IAM) → Add role assignment.
3. Assign Owner or User Access Administrator to the identity that will configure the SRE Agent.
4. Navigate to sre.azure.com and proceed with adding the delegated subscription as a managed resource.
5. Once enrollment is complete, the elevated access can be removed if no longer needed.

References:

• Manage Permissions for Azure SRE Agent — Prerequisites
• Agent Permissions in Azure SRE Agent
• Create and Set Up Azure SRE Agent — Prerequisites
• Azure Lighthouse — Tenants, Users, and Roles (Role Support)
• Managing Multi-Tenant Azure Resources with SRE Agent and Lighthouse (Microsoft Tech Community Blog)

Kindly let us know if the solution provided worked for you.

If you need any further assistance, please feel free to reach out.

If you found the comment helpful, please consider clicking "Upvote it".

Thanks,
Suchitra.