Forum Discussion
Why can I create users via Entra Overview but not via Manage → Users in Azure Portal?
Hi,
I am facing an issue with Microsoft Entra ID in the Azure Portal (portal.azure.com). I am not using the separate Microsoft Entra admin center.
From Entra ID → Overview → + Add → User → Create new user, I can open the user creation page.
However, from Entra ID → Manage → Users → New user, the Create new user option is greyed out. Only Invite external user is available.
My current permissions are:
Azure Contributor: Subscription scope
Azure User Access Administrator: Root scope
Microsoft Entra User Administrator: Not assigned
User Administrator PIM eligibility: Not assigned
Why is Create new user available from the Overview page but disabled under Manage → Users?
Is this expected behavior or a difference in the permission checks/workflows?
I have attached screenshots showing both scenarios.
Thank you
2 Replies
Your screenshots show that the Overview shortcut opens the creation form, while the Users blade disables Create new user. Opening a form is not proof that your account can successfully create a directory user. Azure Contributor and User Access Administrator manage Azure resources and Azure role assignments; they do not grant Microsoft Entra user-management permissions, even at root scope. Microsoft documents User Administrator as the least-privileged built-in role for creating users. Ask your directory role administrator to assign that role at the appropriate scope, using PIM if your organization requires it, then sign in again and test through the Microsoft Entra admin center. Guest invitation has separate permissions and can be allowed by the tenant’s default collaboration settings, explaining why Invite remains available. These documents do not explain the exact difference between those portal controls; report it with both screenshots if it persists after permissions are corrected.
Hello Adnan_yawar ,
This is expected behavior, not a system bug. You cannot create users because you lack the necessary Microsoft Entra ID role (such as User Administrator). The Azure RBAC roles you hold (Contributor, User Access Administrator) do not grant permission for directory-level user creation operations.
Azure RBAC roles (such as Contributor, User Access Administrator) and Microsoft Entra ID roles are two completely separate permission systems.
To create internal users in Entra ID, at minimum the User Administrator role must be held. Having only Azure subscription-level Contributor or User Access Administrator cannot grant this permission.
You need to ask a Global Administrator or Privileged Role Administrator in your tenant to assign you the User Administrator role (or a higher role). After assignment, the "Create new user" button on the Manage → Users page will become clickable.
If the solution helped, would you mark it as solved?
