Azure deny assignments

Az Cloud Learner 71 Reputation points
2020-09-11T12:25:45.123+00:00

Hello Team,
Need suggestion on Azure Deny Assignments, I have user who has permission (Reader + User Access Administrator) to assign the roles, But I would like to restrict same user to assign himself as a Owner / Contributor and delete some of the core components.
Please suggest if this can be achievable.

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
711 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. soumi-MSFT 11,761 Reputation points Microsoft Employee
    2020-09-11T13:34:37.66+00:00

    @Az Cloud Learner , Thank you for reaching out. The User Access Administrator is a special role usually assigned to the Global Admins of the AAD tenants to provide them access on the Azure Resources.

    Azure AD and Azure resources are secured independently from one another. That is, Azure AD role assignments do not grant access to Azure resources, and Azure role assignments do not grant access to Azure AD. However, if you are a Global Administrator in Azure AD, you can assign yourself access to all Azure subscriptions and management groups in your directory. Use this capability if you don't have access to Azure subscription resources, such as virtual machines or storage accounts, and you want to use your Global Administrator privilege to gain access to those resources.

    When you elevate your access, you will be assigned the User Access Administrator role in Azure at root scope (/). This allows you to view all resources and assign access to any subscription or management group in the directory.

    You can read more about this here: https://video2.skills-academy.com/en-us/azure/role-based-access-control/elevate-access-global-admin

    Hope this helps.

    Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as Answer; if the above response helped in answering your query.