I want to delete a managed resource group but there is a deny permission preventing this. There is no deployment stack to work with. I am an owner of the subscription.

Question

I want to delete a managed resource group but there is a deny permission preventing this. There is no deployment stack to work with. I am an owner of the subscription.

Answer 1

Hello @Greg Kohlschreiber

Thank you for posting your query on Microsoft Q&A.

As an administrator, you can lock an Azure subscription, resource group, or resource to protect them from accidental user deletions and modifications. The lock overrides any user permissions.

When you apply a lock at a parent scope, all resources within that scope inherit the same lock. Even resources you add later inherit the same parent lock. The most restrictive lock in the inheritance chain takes precedence.

If you have a Delete lock on a resource and attempt to delete its resource group, the feature blocks the whole delete operation. Even if the resource group or other resources in the resource group are unlocked, the deletion doesn't happen. You never have a partial deletion.

To create or delete management locks, you need access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions. Users assigned to the Owner and the User Access Administrator roles have the required access. Some specialized built-in roles also grant this access. You can create a custom role with the required permissions.

You mentioned that you are owner of the subscription. But please make sure you are owner for the resource group and the resource you are trying to delete/modify.

You need to check if there is any configuration set for 'Deny Assignment' for the resource.

Also please check if the deny assignment is created by a managed application

Managed Applications provide ownership and resource control to the vendor of the application on the managed resource groups. Subscription admins only have permissions that are delegated by the 3rd party vendor.

Usually the deny assignment information contains the details on who created it. This is usually enough to confirm the deny assignment comes from a managed application.

If you want to delete the Managed Application itself, which will delete all the resources including the deny assignment itself and if you need to make modifications, you need to contact the vendor of the managed application for support.

You can see the details of Deny Assignments in Azure portal as shown below.

Reference :

https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments?tabs=azure-portal#list-details-about-a-deny-assignment

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,

Venkata Jagadeep