RBAC Assignments

Question

I believe I am set up for the proper RBAC permissions and can delete\move away from my current Classic Administrator Roles, but am hesitant to do that without someone verifying my RBAC permissions. Can someone help me verify all my Roles are correct?

Answer 1

Hello @Kazda, Tom

We understand that you received an email mentioning below.

As of August 31, 2024, Azure classic administrator roles (along with Azure classic resources and Azure Service Manager) are retired and no longer supported. Starting on April 30, 2025, any Co-Administrator or Service Administrator role assignments will lose access. If you still have active Co-Administrator or Service Administrator role assignments, convert these role assignments to Azure RBAC immediately.

In Classic deployment model, each resource existed independently; there was no way to group related resources together. Instead, you had to manually track which resources made up your solution or application and remember to manage them in a coordinated approach.

Later in 2014, Azure introduced Resource Manager which added the concept of a resource group. A resource group is a container for resources that share a common lifecycle where we can deploy, manage, and monitor all the services for your solution as a group, rather than handling these services individually.

After August 30, 2025, Co-Administrator and Service Administrator roles are retired and no longer supported. You should convert these role assignments to Azure RBAC immediately.

You can use an Azure Portal or Resource Graph query to list subscriptions with Service Administrator or Co-Administrator role assignments.

Follow these steps to list the Service Administrator and Co-Administrators for a subscription using the Azure portal.

• Sign in to the Azure portal as an Owner of a subscription.
• Open Subscriptions and select a subscription.
• Select Access control (IAM).
• Select the Classic administrators tab to view a list of the Co-Administrators.

Remove Co-Administrators that no longer need access

• If user is no longer in your enterprise, remove Co-Administrator.
• If user was deleted, but their Co-Administrator assignment wasn't removed, remove Co-Administrator.

Users that have been deleted typically include the text (User was not found in this directory).

• After reviewing activity of user, if user is no longer active, remove Co-Administrator.

https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators?tabs=azure-portal#list-classic-administrators

How to remove a Co-Administrator

Follow these steps to remove a Co-Administrator.

Sign in to the Azure portal as an Owner of a subscription.

Open Subscriptions and select a subscription.

Select Access control (IAM).

Select the Classic administrators tab to view a list of the Co-Administrators.

Add a check mark next to the Co-Administrator you want to remove.

Select Delete.

In the message box that appears, select Yes.

I suggest you go through the below document for further reference.

https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators?tabs=azure-portal#how-to-remove-a-co-administrator

Please refer the below FAQs

https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators?tabs=azure-portal#frequently-asked-questions

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/deployment-models

I hope this clarifies things.

Please remember to "Accept Answer", so that others in the community facing similar issues can easily find the answers.