unable to create aro cluster facing insufficient permission

I am getting the following error

az aro create \ --resource-gaz aro create \ROUP \ --resource-group $RESOURCEGROUP \ --name $CLUSTER \ \ --domain $CLUSTER \ORK \ --vnet $VIRTUALNETWORK \R-master-subnet  \ --master-subnet  $CLUSTER-master-subnet  \ROUP \ --cluster-resource-group $CLUSTERRESOURCEGROUP \ --worker-subnet $CLUSTER-machine-subnet-1 \ --version  $ARO_VERSION \VM_SIZE \ --master-vm-size $MASTER_VM_SIZE \ --worker-vm-size $WORKER_VM_SIZE \VISIBILITY \ --apiserver-visibility $APISERVER_VISIBILITY \ --ingress-visibility $INGRESS_VISIBILITY \ --lb-ip-count $LB_IP_COUNT No --pull-secret provided: cluster will not include samples or operators from Red Hat or from certified partners. The command failed with an unexpected error. Here is the traceback: Insufficient privileges to complete the operation. Traceback (most recent call last):   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 57, in _send     r = send_raw_request(self._cli_ctx, method, url, resource=self._resource, uri_parameters=param,         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/util.py", line 1046, in send_raw_request     raise HTTPError(reason, r) azure.cli.core.azclierror.HTTPError: Forbidden({"error":{"code":"Authorization_RequestDenied","message":"Insufficient privileges to complete the operation.","innerError":{"date":"2025-08-25T1757","request-id":"334a2e10-2321-4b5f-a2a8-3d77bf63988b","client-request-id":"334a2e10-2321-4b5f-a2a8-3d77bf63988b"}}})The above exception was the direct cause of the following exception:Traceback (most recent call last):   File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke     cmd_result = self.invocation.execute(args)                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 666, in execute     raise ex   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 734, in _run_jobs_serially     results.append(self._run_job(expanded_arg, cmd_copy))                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 703, in _run_job     result = cmd_copy(params)              ^^^^^^^^^^^^^^^^   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 336, in call     return self.handler(*args, **kwargs)            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/command_operation.py", line 120, in handler     return op(**command_args)            ^^^^^^^^^^^^^^^^^^   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/command_modules/aro/custom.py", line 84, in aro_create     validate(cmd,   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/command_modules/aro/custom.py", line 227, in validate     rp_client_sp_id = aad.get_service_principal_id(resolve_rp_client_id())                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/command_modules/aro/_aad.py", line 31, in get_service_principal_id     sps = self.client.service_principal_list(f"appId eq '{app_id}'")           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 184, in service_principal_list     result = self._send("GET", "/servicePrincipals" + _filter_to_query(filter))              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^   File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/command_modules/role/_msgrpah/_graph_client.py", line 60, in _send     raise GraphError(ex.response.json()['error']['message'], ex.response) from ex azure.cli.command_modules.role._msgrpah._graph_client.GraphError: Insufficient privileges to complete the operation. To check existing issues, please visit: https://github.com/Azure/azure-cli/issues

Hi SHYAMALA GOWRI,

Thanks for posting your question in Microsoft Q&A

The error you're seeing Authorization_RequestDenied means your Azure account doesn't have enough permissions to complete creation of aro cluster

To deploy an ARO cluster, your account needs directory-level privileges in Microsoft Entra ID to look up the service principals (identities) that OpenShift uses for creating resources in your subscription

You have Contributor (create resources) and User Access Administrator (assign roles) at the subscription level, but since these are not directory-level roles, these are good, but not enough for all ARO setup steps. you’re hitting the error: Insufficient privileges to complete the operation. Authorization_RequestDenied.

You also need sufficient Microsoft Entra permissions, either a member user of the tenant, or a guest assigned with role Application administrator or Cloud Application Administrator allows creating/reading service principals for ARO. for the tooling to create an application and service principal on your behalf for the cluster. For more information, see Member and guests and Assign Microsoft Entra roles.

Refer document: https://learn.microsoft.com/en-us/azure/openshift/create-cluster?pivots=aro-azure-cli

If tenant-level rights can’t be granted, the Entra admin must pre-create the required ARO service principals and assign them the necessary access in your subscription, so you can deploy the cluster without needing directory admin permissions.

I hope this clarifies the issue. If you run into any more questions, don’t hesitate to reach out. I’ll be glad to help.