& Ldquo; The account does not have a subscription & ldquo ...

A user is trying to connect to an Azure SQL Database via SQL Server Management Studio (SSMS v16.5.1).

The user's current IP address is not listed in the Azure SQL Server's firewall rules.

Because of this the user is shown the New Firewall Rule dialog.

When the user signs in using their Azure Active Directory (Azure AD) credentials they get an error message saying:

Account has no subscriptions

Clicking "Details" shows:

We experienced issues in connecting to Azure Additional information: login account does not have Azure subscriptions. (Microsoft.SqlServer.Management.ApplicationAuthenticationManagement)

Why is the user getting this error message and how can they add a new firewall rule for their IP address?

Image may be NSFW.
Clik here to view.

Azure support have shared the below with me, based on an Azure documentation article .

Given an Azure SQL Server, only the Active Directory admin or SQL Server admin have permissions to add firewall rules at the server level.

The above error message (somewhat obscurely) indicates that the user is neither.

Image may be NSFW.
Clik here to view.

My personal experience also suggests that Azure AD accounts that are assigned as Subscription Co-administrators can also set firewall rules.

If, and only if, giving the user permissions is appropriate, this can be done by one of three ways:

Specifying the user as the SQL Server admin .

Setting the server's Active Directory admin to be an Azure Active Directory Group and making the user's AD account a member of this group.

Making the user a Co-administrator for the Subscription via https://manage.windowsazure.com/

Be sure to understand the security implications of each option before taking action.