Deny assignments has a developer blocked, is there a work around?

Question

We are unable to find a work around to Deny assignments in our Subscription for a developer that is attempting to set up and deploy to our Azure Platform. There is no option to delete the Deny assignment within Azure. The user role apparently does not matter. The system note is that the user is doing an "Unusual Activity". This is a tad perplexing. Any thought/help is greatly appreciated. We have attempted online suggestions, so far to no avail.

Also the child tag is not relevant as none seemed appropriate, but one had to be selected.

John

Answer 1

Hi John,

The system has automatically placed the Deny assignments due to detected potential strange activity. It may be a "false positive" or actual issue, but either way you need to contact support to have the block lifted.

Please create a subscription management support request so you can discuss with engineer and have them restore the subscription to normal status. Subscription support is free.

Please carefully follow my instructions below to create support request and avoid getting stuck in endless loop. Please let me know if you run into any issues.

1. Navigate to this link to start the process:

https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade/~/overview

2. Click Create a support request button at top

3. If you see Support AI Assistant as shown below, click Switch to old experience button on right. If not, proceed to step #4

4. On left, enter re-enable subscription in the box and click Go

5. Select Subscription management and click Next

6. Select your subscription from the dropdown and click Next

7. At this point there will be a delay of several seconds, and then various options will be displayed. Click Create a support request button at the top. DO NOT CLICK any of the other options.

8. Fill out screen, Summary, Problem type: Re-enable my subscription, Problem subtype: Could not reactivate by self-service, then click Next button at bottom.

9. There will be another several second delay, and then some solutions will be displayed (this is similar to above). DO NOT CLICK any of the solutions, instead click on Return to support request button in upper left corner, similar to below

10. Now you are back at support case. Click Next button at bottom to continue to Additional details tab. Fill out information as required. Click Next to advance to Review + create tab, then click Create.

You should receive an automated email within a few minutes and then be contacted by support within 1 business day.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Answer 2

Hi

Deny assignments are basically Azure Policy assignment with deny effect. One option is to contact the administrator who has created these Azure policies and resolve the issue with him/her. In any case the policy assignment either needs to be removed or exemption to be created or exclusions. Only users with appropriate permissions on Azure Policies can do these actions. Note that Azure policies can be assigned at different scopes so the permissions should be valid for the scope those policies are assigned.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 3

Hello @John Havenar,

In addition to the information provided by @Stanislav Zhelyazkov , please refer to the below mentioned steps to remove the users from Deny Assignments list from Azure Portal.

Based on the error message what you are getting, I understand that your user account has been added to a Deny Assignments list at the root level.

Deny assignments block users from performing specific Azure resource actions even if a role assignment grants them access.

Important

You can't directly create your own deny assignments. Deny assignments are created and managed by Azure to protect resources.

Prerequisites

To get information about a deny assignment, you must have:

• Microsoft.Authorization/denyAssignments/read permission, which is included in most Azure built-in roles.

List deny assignments in the Azure portal

Follow these steps to list deny assignments at the subscription or management group scope.

1. In the Azure portal, open the selected scope, such as resource group or subscription.
2. Select Access control (IAM).
3. Select the Deny assignments tab (or select the View button on the View deny assignments tile). If there are any deny assignments at this scope or inherited to this scope, they'll be listed as mentioned in the below Screenshot. 4. To display additional columns, select Edit Columns. 5. Add a checkmark to any of the enabled items and then select OK to display the selected columns.

Delete deny assignments in the Azure portal

1.Please make sure that you are having a role with enough privileges, like Owner or User Access Administrator.

2.Under the Deny assignments tab, select the affected user account and then delete or Remove the affected user account from Deny assignments list.

For additional details, please refer to the below document for your reference.

List Azure deny assignments - Azure RBAC | Microsoft Learn

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".