Not able to create new Subscription using Terraform

Terraform Providers Azure
1

Using the same service connection in CLI script, new subscription is created but when I try to create using Terraform, it said,

Error: creating new Subscription (Alias “*******************”): subscription.AliasClient#Create: Failure sending request: StatusCode=401 – Original Error: Code=“UserNotAuthorized” Message=“User is not authorized to create subscriptions on this enrollment account”

Terraform Version
1.1.6
AzureRM Provider Version
3.46.0

script ref
data “azurerm_billing_enrollment_account_scope” “example” {
billing_account_name = “1234567890”
enrollment_account_name = “0123456”
}

resource “azurerm_subscription” “example” {
subscription_name = “My Example EA Subscription”
billing_scope_id = data.azurerm_billing_enrollment_account_scope.example.id
}

2

Based on the error, it appears the account this is running as does not have permissions at the EA level to create a new subscription.

3

agreed, but with same account, I am able to create using Azure CLI command. if permission issue is with SPN then it should not create using CLI.

4

Finally I got the solution. in Azure DevOPS, service connection scope was subscription and now I changed it to Management group which is working fine.
Doc ref