Skip to main content
selectdraftMicrosoft Azure
Servicessubscription
CredentialsAZURE_TENANT_ID AZURE_CLIENT_ID AZURE_CLIENT_SECRET
PermissionsMicrosoft.Resources/subscriptions/read

Azure subscription detail

Reads a subscription's name and state. Unlike most Azure resources this one is not readable by an ordinary service principal: the API restricts it to subscription owners and returns UserNotAuthorized otherwise, so treat a failure here as an authorization outcome rather than a broken query.

Query​

SELECT name, state
FROM azure.subscription.subscriptions
WHERE subscription_id = '{{subscription_id}}';

Notes​

subscription_id is required - this reads one subscription rather than enumerating them, so it cannot be used to discover which subscriptions a credential can reach. A service principal without the Owner role gets HTTP 401 with code UserNotAuthorized and the message that only subscription owners can perform the operation; that is the expected result for the least-privilege credentials most automation uses, not a defect. When the goal is simply to confirm a credential works against a subscription, list resource groups instead - see azure/resource/resource-groups-lifecycle - which needs only Reader. This entry is draft because the owner-only path has not been exercised successfully; the authorization failure is the only behaviour that has been observed.

Related queries

  • Azure resource group lifecycle - Lists resource groups in a subscription, and creates or deletes one; the container every other Azure resource lives in.