Question: I am trying to get all subscriptions in a Python script. Therefore I created a service principal and added it to the `Global administrator` role.

Still I have to manually add the user within each subscription which is unwanted as I want to create a report over our Azure resources automatically without remembering to provide explicit access for a service user.

My code is:

```py
from azure.common.credentials importServicePrincipalCredentials
from azure.mgmt.subscription import subscription_client
from pprint import pprint

def get_credentials():
    cred = ServicePrincipalCredentials(
        client_id="a",
        secret="b",
        tenant="c"
    )
    return cred

if __name__ == '__main__':
    credentials = get_credentials()
    client = subscription_client.SubscriptionClien(credentials, None)
    for i in client.subscriptions.list(filter="*"):
        pprint(i.display_name)

```

I have more than 5 subscriptions in the tenant but only two (one was added automatically, the other one I add manually) show up

Answer: 
> 
> Still I have to manually add the user within each subscription which
>  is unwanted as I want to create a report over our Azure resources
>  automatically without remembering to provide explicit access for a
>  service user.
> 
> 
> 

This is intended behavior. Essentially Azure AD is a user store and it has no idea about what all resources a user has (or need) access to. 

Granting this user a `Global Administrator` role will make the user a global administrator in that Azure AD only. 

You will need to grant access explicitly on the Azure Subscriptions to this user using Azure Subscription Role-based Access Control (RBAC).
For the sake of the next person to seek this info...Instead of adding the user manually (portal, CLI, or script), to each subscription, you can add them, just once, to the Tenant Root Group and permissions will be cascaded to all other subscriptions which exist now, as well as any future subscriptions.

In the web portal, Home -> Management groups -> Tenant Root Group (details) -> IAM -> Role Assignments -> Add -> Add role assignment -> [fill in the desired values] -> Save