Unable to create child management group as of version 2.27.1

[mdtro]

Describe the bug

$ az account management-group create --name "test123" --parent "MyTestMG"

In version 2.27.0, creating a child management group. As of 2.27.1, the same command is failing with the error message:

(AuthorizationFailed) The client '<spn id>' with object id '<spn id>' does not have authorization to perform action 'Microsoft.Management/register/action' over scope '/subscriptions/<subscription id>' or the scope is invalid. If access was recently granted, please refresh your credentials.

To Reproduce

To recreate this issue, you'll need the following:

• A management group, for example named "MyTestMG".
• A subscription (does not need to be a member of the above management group).
• A SPN with the following roles assigned:
  • Reader at the subscription scope.
  • Management Group Contributor at the "MyTestMG" management group scope.
• An AzureCLI (version >=2.27.1) shell logged in as your SPN.
• An Azure PowerShell instance logged in as your SPN.

Running the following will fail with an error message.

$ az account management-group create --name "test123" --parent "MyTestMG"

(AuthorizationFailed) The client '<spn id>' with object id '<spn id>' does not have authorization to perform action 'Microsoft.Management/register/action' over scope '/subscriptions/<subscription id>' or the scope is invalid. If access was recently granted, please refresh your credentials.

In Azure PowerShell (I tested with version 6.4.0.34709), the equivalent command with the same SPN and assigned roles will complete successfully and create the child management group.

$parentGroup = Get-AzManagementGroup -GroupName MyTestMG
New-AzManagementGroup -GroupName 'test123' -ParentId $parentGroup.id

Expected behavior
With both AzureCLI and Azure PowerShell, I would expect them to behave the same way and create the child management group with the same roles/permissions assigned to the SPN.

Environment summary
AzureCLI >=2.27.1
Azure PowerShell 6.4.0.34709

Azure environment:

• A management group, for example named "MyTestMG".
• A subscription (does not need to be a member of the above management group).
• A SPN with the following roles assigned:
  • Reader at the subscription scope.
  • Management Group Contributor at the "MyTestMG" management group scope.

[jiasli]

Indeed, Azure CLI registers the Microsoft.Management Resource Provider before performing any management group operations.

azure-cli/src/azure-cli/azure/cli/command_modules/resource/custom.py

Lines 2820 to 2826 in ba44e95

	def cli_managementgroups_group_create(
	cmd,
	client,
	group_name,
	display_name=None,
	parent=None):
	_register_rp(cmd.cli_ctx)

azure-cli/src/azure-cli/azure/cli/command_modules/resource/custom.py

Lines 2808 to 2814 in ba44e95

	def cli_managementgroups_group_show(
	cmd,
	client,
	group_name,
	expand=False,
	recurse=False):
	_register_rp(cmd.cli_ctx)

This behavior has been there since 2018-06-01 introduced by #6426. A question on it was raised in #6426 (comment) and explained in Azure/azure-cli-extensions#62 (comment).

There are 2 approaches we can take:

1. Remove the _register_rp invocation so that the Microsoft.Management Resource Provider registration is not performed. Error out and provide recommendation if Microsoft.Management Resource Provider is not already registered.
2. Add and option like --no-register to avoid this behavior.

[zhoxing-ms]

This is a known issue, the addition of _register_rp() operation is caused by the history issue of service: tenant-level resources and subscription-level resources cannot support automatic RP registration on server side
Historical discussions: Azure/azure-cli-extensions#62 (comment)

wwendyc Could you help to look at the following questions? Or do you know who can look it?
May I ask has the service solved the problem of automatic RP registration? If so, CLI can remove the _register_rp() operation, right?

[yonzhan]

wwendyc since we did not receive response from service team, Azure CLI team plans to add a toggle to remove the _register_rp() operation. Due to a bunch of Ignite deliveries in this sprint. The ETA of this feature is 12-07.