Recreate foreign principal role assignment (for CSP)

As a CSP, you may need to recreate the foreign principal role assignment on a customer subscription. First, you need to get the ID of your “AdminAgents” security group from the Azure Active Directory of your CSP tenant.

Then, using Azure CLI, connected with a user having appropriate IAM role to assign roles on the subscription:

az role assignment create --assignee <AdminAgents_group_id> --role "Owner" --scope "/subscriptions/<subscriptionID>"