How to check/change for legacy roles?

Question

We received an email indicating legacy roles are being discontinued, and that certain roles need to be converted to RBAC. We are not Azure users, but are technical, and don't understand the strange terminology being used. How do we check to see if any roles are the legacy types? And if there are any, how do we change them to RBAC. The email sent has no instructions and no link to real instructions. The only links are to a copy of the email, and links for contacting support.

Answer 1

Hello

Thanks for reaching out to Microsoft Q and A Forum ,

These instructions will help you identify the legacy roles and also help you in migrating:

1. Navigate to the Azure Portal → Azure Active Directory, then go to Roles and administrators and search for roles marked as "Legacy". Use Microsoft Entra ID → Privileged Identity Management (PIM) to review role assignments.
2. In Azure AD, navigate to Users → Directory role assignments and export role assignments via Microsoft Graph API or Azure PowerShell using:

Get-AzRoleAssignment | Where-Object { $_.RoleDefinitionName -like "*Legacy*" }

3. Compare legacy roles with Microsoft Entra built-in roles (https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles?toc=%2Fentra%2Fidentity%2Frole-based-access-control%2FTOC.yml&bc=%2Fentra%2Fidentity%2Frole-based-access-control%2Fbreadcrumb%2Ftoc.yml ) and assign equivalent RBAC roles in Azure AD or Azure Subscription IAM.
4. In Azure Portal, go to Access control (IAM) → Remove legacy role assignments. Use PowerShell to remove outdated roles:

Remove-AzRoleAssignment -ObjectId -RoleDefinitionName ""

I hope it was helpful, please don't forget to accept the answer if this was resolved your scenario.

Thanks

Answer 2

Hello A_User5555

Adding more points to Pradeep, even if you do not see any "Classic Administrators" in your Azure subscriptions, you might have received the email due to hidden or legacy role assignments for users or apps that still exist within your Azure environment.

You can run the below command in Azure CLI to list all the Classic Administrators in your subscription. Please verify across all the subscriptions that you have access to.

az role assignment list --all --query "[?roleDefinitionName=='Co-Administrators']"

1.Legacy Classic Administrators Exist in the Background

-Even if you don't see Classic Administrators in Azure Portal, there might be hidden assignments that need conversion.

-Microsoft is retiring Classic Administrators (e.g., Co-Administrator, Service Administrator) and enforcing Azure Role-Based Access Control (RBAC).

2.Multiple Subscriptions Under Your Account

-If you manage multiple Azure subscriptions, one of them may still have Classic Administrators assigned.

-Check all subscriptions in Azure Portal under "Subscriptions" → "Access Control (IAM)".

3.Microsoft Enforcing Migration to RBAC

-Microsoft is automatically enforcing migration from Classic roles to Azure RBAC roles, and the email serves as a notification.

https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators?tabs=azure-portal

If you run this command and get an empty array as a response, then you don't have any users or apps with classic administrators (co-admin or service admin) you will not have any impact.

Check this similar Q&A post where I have explained in detailed regarding "Transition to role-based access control (RBAC)": https://learn.microsoft.com/en-us/answers/questions/2236690/i-need-help-with-azure-rbac

I hope this clarifies things.