Get-MsolRoleMember : Access Denied. You do not have permissions to call this cmdlet.

[jgrzybo]

Steps to reproduce

Have a Microsoft Partner Portal Account
Have Customers/tenants in the Portal
Have an account in the Partner portal
Be part of the security group AdminAgents
Have an Admin Relationship with a Customer with the Microsoft Entra roles : Global Administrator assigned
Assign the AdminAgents Security Group to the Admin Relaationship
Open Powershell
Run command "Connect-MsolService" and login with the above mentioned account

Run the following Powershell script ( GetGA.ps1 )
#Working Tenant
#$tenantId = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy"
#NotWorking Tenant
$tenantId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
$roles = Get-MsolRole
#Write-Host $roles.Name
$role = Get-MsolRole -RoleName "Company Administrator"
$globalAdmins = Get-MsolRoleMember -RoleObjectId $role.ObjectId -TenantId $tenantId
Write-Host $globalAdmins.DisplayName

See the script works when the Working Tenant tenant id is uncommented
Output "Admin Company Admin Break Glass Admin"

See the script fail when the NotWorking Tenant tenant id is uncommented
Get-MsolRoleMember : Access Denied. You do not have permissions to call this cmdlet.
At C:\temp\GetGA.ps1:8 char:21

• ... balAdmins = Get-MsolRoleMember -RoleObjectId $role.ObjectId -TenantId ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OperationStopped: (:) [Get-MsolRoleMember], MicrosoftOnlineException
  • FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.AccessDeniedException,Microsoft.Online.Admini
    stration.Automation.GetRoleMember

Expected behavior

Would expect both runs to return a list of the Gloabal Administartors for the respective tenant
Output "Admin Company Admin Break Glass Admin"

Actual behavior

On one of the accounts I get

Get-MsolRoleMember : Access Denied. You do not have permissions to call this cmdlet.
At C:\temp\GetGA.ps1:8 char:21

• ... balAdmins = Get-MsolRoleMember -RoleObjectId $role.ObjectId -TenantId ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OperationStopped: (:) [Get-MsolRoleMember], MicrosoftOnlineException
  • FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.AccessDeniedException,Microsoft.Online.Admini
    stration.Automation.GetRoleMember

Diagnostic logs

None

Environment

PSVersion 5.1.19041.4291
PSEdition Desktop