This is actually working as intended, though I agree the flow is confusing and the error message is unhelpful. Let me explain how roles work so you can get the result you want.
Two different things are called “roles” here:
- The role type (User / Admin / Custom). This is the top-level choice on an account’s Roles field.
- Custom role objects, like the ones you see in the role directory (“Tenant Administrator”, “System Administrator”, “User”, “Group”).
The built-in “Tenant Administrator” and “System Administrator” entries are global objects. They are not meant to be attached to an account directly. Instead, they are wired up behind the scenes as the defaults for the Admin role type:
- An account with type Admin that belongs to a tenant automatically receives the tenant administrator permissions (the global “Tenant Administrator” role plus the base “User” role).
- An account with type Admin that is not in a tenant receives the system administrator permissions instead.
So the correct way to make your account a tenant administrator is:
Account → Groups & Roles → Roles → set the type to Admin (not Custom) → Save.
Because the account is a member of a tenant, “Admin” resolves to tenant administrator scope automatically. You do not select “Tenant Administrator” from the list.
You may ask, why “Custom → Tenant Administrator” fails? Custom roles are tenant-scoped. A tenant account can only reference roles that belong to its own tenant. The built-in “Tenant Administrator” is a global role with no tenant, so a tenant account cannot reference it directly. This is a deliberate isolation boundary: if tenant accounts could attach arbitrary global roles, a tenant admin could grant themselves “System Administrator” and escape the tenant. That is exactly what the check prevents. This is also why it works when the account is not in a tenant: a global account can reference global roles.
The “Custom” type is intended for roles you create inside your tenant, when you want a permission set different from the standard Admin/User defaults.
On our side we will improve two things: the Custom role picker should not list global roles that cannot be assigned to a tenant account, and the error message should explain this instead of the generic “references another item that does not exist.”