Admin‑On‑Behalf‑Of issue when purchasing subscription

What you’re seeing is probably two separate relationships being conflated. For a newly provisioned Azure plan subscription, AOBO is created for the transacting CSP—here, the indirect provider. The indirect reseller’s AdminAgents foreign group is not necessarily added automatically just because a GDAP relationship exists. GDAP grants tenant-directory permissions; it does not itself create subscription-level Azure RBAC.

First verify which tenant and object the existing foreign-principal Owner assignment belongs to. If it is the provider, ask the provider, while it still has AOBO and Owner, to grant your AdminAgents foreign-group object ID the required subscription role; the customer does not need to elevate access. Also confirm your Azure-management security group is nested in AdminAgents and the GDAP relationship is active.

If even the indirect provider’s foreign principal is missing on a newly created, non-transferred subscription, treat that as a provisioning failure and have the provider open a Partner Center support case. Transfers are different: AOBO is not recreated automatically.