Some permissions take 24 hours, so assign them on day one
We reached the final step of a migration, assigned the role it required, and found a banner explaining it might take 24 hours to work.
Almost every permission change in a cloud admin console applies immediately, or within a few minutes of signing out and back in. That trains you to assign permissions when you need them.
Then you meet one that does not. In Microsoft 365, the mailbox import and export role is documented as taking up to 24 hours before you can create import jobs. The option to create one simply does not appear until it has propagated. No error, no progress indicator, just an absent button and a note explaining why.
Why this hurts more than it should
Permissions with a lead time are almost always required at the end of a piece of work, because they gate the final action rather than the preparation. So you hit them when everything else is finished, when you have set aside the time, and often when someone is waiting.
The habit worth forming
At the start of any migration or platform build, list every action you will eventually need to take, and assign the permissions for all of them on day one. Not when you reach that step.
It costs nothing to hold a role you have not used yet. It costs a day to discover you needed it yesterday.
Anything involving import, export, discovery, compliance search or billing tends to sit behind a role that is neither granted by default nor instant to apply. Being a global administrator does not automatically include them.
The wider version
Ask of any dependency: does this apply immediately, and if not, how long? Directory replication, certificate issuance, DNS propagation, licence provisioning and role assignment all have lead times measured in hours rather than seconds. A plan that assumes everything is instant is a plan with an unexploded delay in it.
Need help with any of this?
These notes are free and always will be. If you would rather someone just set it up, or you are stuck on something similar, get in touch at hello@opsira.io.