Unable to create Azure billing support request after account compromise because my subscription permissions are "Unknown"

Question

Unable to create Azure billing support request after account compromise because my subscription permissions are "Unknown"

Edgar Salas 25

Hello, I need guidance regarding an Azure billing issue after my Microsoft account was compromised. Some time ago, my Microsoft account was accessed without my authorization. After discovering this, I immediately changed my password and enabled Microsoft Authenticator with MFA. Recently, I received an Azure invoice for approximately USD 642 for resources that I did not create or authorize. Current situation:

The Azure resources no longer exist.
I can sign in to portal.azure.com.
My subscription is still Active.
My role is shown as "Unknown".
Account Administrator shows "Unauthorized".
Billing Period shows "Unauthorized".
I cannot view IAM role assignments.
I cannot create an Azure billing support request because Azure says I do not have permission for the subscription. Microsoft Consumer Support reviewed my case (Case 7105574141) and referred me to Azure Commercial Support. However, Azure Commercial Support requires creating a billing support request, which I cannot do due to the missing permissions. Has anyone experienced this situation? Is there another way to reach Azure Commercial Support when you cannot create a support request because of subscription permissions? Any guidance would be greatly appreciated. Thank you.

0 comments

Answer accepted by question author

Nathan Roberts (SN) 12,936 Student Ambassador Volunteer Moderator

Hey there, Edgar Salas

Some time ago, my Microsoft account was accessed without my authorization. After discovering this, I immediately changed my password and enabled Microsoft Authenticator with MFA.

Sorry to read that you have been hacked in the past. Getting your account back, changing your password and adding two-step verification is a good first step. As the attacker managed to get onto Azure and create resources, which you were billed for, please can you sign into your account on the Microsoft Entra ID blade in the Azure portal here: https://portal.azure.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/~/AllUsers

Please check that the hacker hasn't added their own account to your tenant. If you do find any users who you don't recognise, please remove them so they are unable to access your tenant and resources.

Sometimes, what could happen is hackers will add their accounts to the tenant and then remove administrator privileges from your user account, while making them have administrator rights. This is why it would be worth checking your assigned roles and Azure role assignments, by clicking onto your user account and then assigned roles, found on the left-hand side menu

User's image

My subscription is still Active.

My role is shown as "Unknown".

Account Administrator shows "Unauthorized".

Billing Period shows "Unauthorized".

I cannot view IAM role assignments.

From what you have listed, it sounds like the hacker has removed IAM permissions from your account so you are unable to manage the subscription. This is what made me think they may have added another account in your tenant that will have an owner role on that subscription. AS for why it shows as unknown, this is probably because the subscription is linked to your account at billing level. This is why you received billing notifications.

If you do not have an owner role for the subscription, you won't be able to assign roles in Azure ABAC.

I cannot create an Azure billing support request because Azure says I do not have permission for the subscription.

As you don't have access to the subscription, creating a support request is not going to be possible because support requests must be attached to a subscription.

Instead, please sign into your account on the subscription blade here: https://portal.azure.com/#view/Microsoft_Azure_Billing/SubscriptionsBladeV2

Once you have signed into your account, please click onto "Add" in the top-left under subscriptions.

User's image

This will open a side panel, where you can create a new subscription. Please enter a name for the subscription and select your account as the billing account. Then go through the other tabs, before finally going through to review and create.

Once you have created the subscription, please create a support request using the help & support blade here: https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade

Please be aware, when creating a support request, it may take time for the support team to respond to you.

Hope this helps,
Nathan

Edgar Salas 25 Reputation points

2026-07-13T22:52:10.91+00:00

Hi Nathan,

Thank you so much for your guidance. Your suggestion was exactly what led me to the root cause of the problem.

I checked my Microsoft Entra tenant and found an external guest account that I did not recognize:

jisog817_gmail.com#EXT#@edgarsalasbirruetagmail.onmicrosoft.com

This account had both the Global Administrator directory role and the Owner role on my Azure subscription.

My own account had lost all Azure role assignments, which is why my role appeared as "Unknown" and I was unable to create Azure support requests or manage the subscription.

Following your advice, I enabled Access management for Azure resources for Global Administrators, recovered ownership of the subscription, removed the unauthorized account's Owner role, revoked its Global Administrator privileges, and removed the account from my tenant.

I also documented everything with screenshots before making any changes.

Now I will open an Azure Billing support request to report the unauthorized Azure resources and request an investigation into the charges that were generated while the attacker controlled the subscription.

Thank you again for taking the time to help me. Without your explanation, I probably would never have found the unauthorized owner account.
Nathan Roberts (SN) 12,936 Reputation points Student Ambassador Volunteer Moderator

2026-07-14T19:39:59.9833333+00:00

You're welcome, Edgar Salas

Always happy to help where I can :)

I am glad you have managed to get your tenant and subscription back under control. I am hopeful that Azure support will be able to help you get refunds on what was spent. Especially if you have documented everything. I would also pass the email onto Microsoft through the support request, as they may be able to investigate further and take any action.

The chances are this person has done this to other admins.

Thanks,
Nathan

1 additional answer

Your answer

Edgar Salas 25 Reputation points

2026-07-13T22:52:10.91+00:00

Hi Nathan,

Thank you so much for your guidance. Your suggestion was exactly what led me to the root cause of the problem.

I checked my Microsoft Entra tenant and found an external guest account that I did not recognize:

jisog817_gmail.com#EXT#@edgarsalasbirruetagmail.onmicrosoft.com

This account had both the Global Administrator directory role and the Owner role on my Azure subscription.

My own account had lost all Azure role assignments, which is why my role appeared as "Unknown" and I was unable to create Azure support requests or manage the subscription.

Following your advice, I enabled Access management for Azure resources for Global Administrators, recovered ownership of the subscription, removed the unauthorized account's Owner role, revoked its Global Administrator privileges, and removed the account from my tenant.

I also documented everything with screenshots before making any changes.

Now I will open an Azure Billing support request to report the unauthorized Azure resources and request an investigation into the charges that were generated while the attacker controlled the subscription.

Thank you again for taking the time to help me. Without your explanation, I probably would never have found the unauthorized owner account.
Nathan Roberts (SN) 12,936 Reputation points Student Ambassador Volunteer Moderator

2026-07-14T19:39:59.9833333+00:00

You're welcome, Edgar Salas

Always happy to help where I can :)

I am glad you have managed to get your tenant and subscription back under control. I am hopeful that Azure support will be able to help you get refunds on what was spent. Especially if you have documented everything. I would also pass the email onto Microsoft through the support request, as they may be able to investigate further and take any action.

The chances are this person has done this to other admins.

Thanks,
Nathan

Answer 1

Azure billing and subscription support is available at no cost, and the supported path is to create an Azure support request.

Because the subscription currently shows Unknown permissions and Unauthorized for billing-related fields, the practical next step is to try creating the request from the Azure portal support flow rather than from the subscription blade:

Open Help + Support in the Azure portal.
Select Create a support request.
In Support + Troubleshooting, search for Billing and select it.
Select the affected subscription and continue.
If suggested solutions appear, scroll down to Contact Support and select Create a support request.
If the portal loops back to solutions again, select Return to support request, then continue through Additional details and Review + create.

If the portal still blocks ticket creation because of the missing subscription permissions, use the Azure support request channel for help signing in or accessing support. Azure documentation states that if help is needed and sign-in to the Azure portal is not possible, a support request can be created through the support entry point.

For the compromised-account aspect, Microsoft guidance also says to contact Azure support immediately and report the incident.