This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 36%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
Hi all,
after deleted erroneously some role from my user, I'm no longer able to operate with my subscription/account. I deleted some role from my user and now it seems be blocked. I'm not able to add permission/role again. It's a deadlock. I'm trying to delete subscription and create a new one but being the trial account I can't it.
Some advices? How I can unlock it?
Regards
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(105.60000000000001, 1%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMS%3C/text%3E%3C/svg%3E)
Ok, that sounds not great.
In general, you should still have an identity with a global admin role in the tenant because you can't remove this role from the last user in your tenant. It's the lock-out protection. So a global admin can only remove permissions or the global admin role from other global admin identities but not from self.
Could it be possible that you want to do the actions with an account that no longer has permission but there is another account with GA permissions?
I'm new to azure... could you give me some instruction in order to do this check?
Thanks in advance
The easiest way is when you login into the Azure portal via the following link:
https://portal.azure.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles/adminUnitObjectId//resourceScope/%2F
You should see the Roles and administrators blade.
There you could search for Global Admin and see the Assignment Count in the column.
If it is more than zero, you can check which user has the permissions, when you click on the number (link in blue)
Thanks for support. I follow your instruction and the global admin is already set for user I'm using. Despite that, I'm not able to perform a lot of actions. I attach 3 screenshot. Regards
Screenshot 2024-09-21 at 18.50.53.png
Ok I think whats your problem.
You need to elevate your permissions to manage Azure/ARM (Azure Resource Manager)
There is a permission hierarchy diagram, to understand what I mean:
To elevate your permission of Global Admin für Azure Management follow the instructions here:
Hi Patchfox and thanks for your time.
I checked that setting and it was already on YES.
Look at attachment please.Screenshot 2024-09-23 at 15.17.20 3.png
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 45%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAV%3C/text%3E%3C/svg%3E)
Hi @sb
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Hi akhilesh, unfortuntely I not yet resolved... my concern is that I will be charged after trial period due to the fact that I can't manage my subscription and delete my resource
Hi @sb
Could you please check now that you able to assign the roles to users? if you are unable to do, please check your role under your profile and see what role you have been assigned.
For reference Assign user roles with Microsoft Entra ID
