Is it possible to remove the User Access Administrator role from a subscription?

Question

Is it possible to remove the User Access Administrator role from a subscription?

Asier-5655 0

Hello,

I have several subscriptions in my Tenant and I would like to make one of them completely private.

Now I have 2 users with User Access Administrator role and I would like to have a specific subscription without them.

Would it be possible?

I am trying to get the list of subscription roles but I am not getting any users with this command:

Get-AzRoleAssignment | where {$_.RoleDefinitionName -eq "User Access Administrator" -and $_.Scope -eq "/subscriptions/{subscription-id}/"}

Is it possible to do what I want?

Thanks in advance.

Vinodh247 34,666 Reputation points MVP Volunteer Moderator

2023-09-14T16:16:35.69+00:00
Hi Asier-5655:

Thanks for reaching out to Microsoft Q&A.

Yes user Access Administrator role assignments can be removed using Azure PowerShell, Azure CLI, or the REST API.

https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin#remove-elevated-access

To remove the User Access Administrator role assignment for a user: CLI

az role assignment delete --assignee username@example.com --role "User Access Administrator" --scope "/"

To remove the User Access Administrator role assignment for a user: POWERSHELL

Remove-AzRoleAssignment -SignInName <username@example.com> ` -RoleDefinitionName "User Access Administrator" -Scope "/"
alamjeet singh 0 Reputation points

2023-09-14T16:36:26.62+00:00

Implication of User Access Administrator role is that it allows user to manage access to Azure resources. So user with this role can add or remove access for other users to subscription or other resources with in subscription.

To make subscription private you need to: Remove unncessary users or group that should not have access to the subscription. This could be any thing like service principals, managed identities or users or groups on your tenant.

And perform an audit to role assignments check if there is any custom role that is granting any permissions.

Only deleting User Access administrators will not make subscription private.
Vinodh247 34,666 Reputation points MVP Volunteer Moderator

2023-09-15T04:31:33.31+00:00

Hi Asier-5655: Just checking if you had a chance to look at this, if so can you please update?
Asier-5655 0 Reputation points

2023-09-15T09:50:22.9733333+00:00

Hi, I was able to remove the user from the User Access Administrator role, but from all subscriptions with the solution provided by @Vinodh247 .

I first had to grant myself access to that feature by toggling Access management for Azure resources in the AAD properties.

This was not what I was looking for, I was looking to remove this inherited access only for a specific subscription. Any ideas on how to do this?

Thanks.
Vinodh247 34,666 Reputation points MVP Volunteer Moderator

2023-09-16T01:16:01.4966667+00:00

Asier-565:

did you try this method to remove the users before?
Vinodh247 34,666 Reputation points MVP Volunteer Moderator

2023-09-17T16:26:51.7866667+00:00

Just checking if you had a chance to look at this, if so can you please update?
Asier-5655 0 Reputation points

2023-09-18T07:52:42.2333333+00:00

Yes, since I am trying to delete an inherited access I have to do it by commands.
Asier-5655 0 Reputation points

2023-09-18T07:53:11.48+00:00

Yes, since I am trying to delete an inherited access I have to do it by commands.

Your answer

Vinodh247 34,666 Reputation points MVP Volunteer Moderator

2023-09-14T16:16:35.69+00:00

Hi Asier-5655:

Thanks for reaching out to Microsoft Q&A.

Yes user Access Administrator role assignments can be removed using Azure PowerShell, Azure CLI, or the REST API.

https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin#remove-elevated-access

To remove the User Access Administrator role assignment for a user: CLI

az role assignment delete --assignee username@example.com --role "User Access Administrator" --scope "/"

To remove the User Access Administrator role assignment for a user: POWERSHELL

Remove-AzRoleAssignment -SignInName <username@example.com> ` -RoleDefinitionName "User Access Administrator" -Scope "/"
alamjeet singh 0 Reputation points

2023-09-14T16:36:26.62+00:00

Implication of User Access Administrator role is that it allows user to manage access to Azure resources. So user with this role can add or remove access for other users to subscription or other resources with in subscription.

To make subscription private you need to: Remove unncessary users or group that should not have access to the subscription. This could be any thing like service principals, managed identities or users or groups on your tenant.

And perform an audit to role assignments check if there is any custom role that is granting any permissions.

Only deleting User Access administrators will not make subscription private.
Vinodh247 34,666 Reputation points MVP Volunteer Moderator

2023-09-15T04:31:33.31+00:00

Hi Asier-5655: Just checking if you had a chance to look at this, if so can you please update?
Asier-5655 0 Reputation points

2023-09-15T09:50:22.9733333+00:00

Hi, I was able to remove the user from the User Access Administrator role, but from all subscriptions with the solution provided by @Vinodh247 .

I first had to grant myself access to that feature by toggling Access management for Azure resources in the AAD properties.

This was not what I was looking for, I was looking to remove this inherited access only for a specific subscription. Any ideas on how to do this?

Thanks.
Vinodh247 34,666 Reputation points MVP Volunteer Moderator

2023-09-16T01:16:01.4966667+00:00

Asier-565:

did you try this method to remove the users before?
Vinodh247 34,666 Reputation points MVP Volunteer Moderator

2023-09-17T16:26:51.7866667+00:00

Just checking if you had a chance to look at this, if so can you please update?
Asier-5655 0 Reputation points

2023-09-18T07:52:42.2333333+00:00

Yes, since I am trying to delete an inherited access I have to do it by commands.
Asier-5655 0 Reputation points

2023-09-18T07:53:11.48+00:00

Yes, since I am trying to delete an inherited access I have to do it by commands.

Share via

Is it possible to remove the User Access Administrator role from a subscription?

Your answer