i'm unable to remove deny assignment on users on my subscription

Question

All users on my subscription are unable to create or assign resources. they always got the error on the image attached.
i have checked the IAM -> deny assignment on the subscription and it is read only

Answer 1

Hi, you can't delete a deny assignment in Azure because all of them are marked as IsSystemProtected = true, meaning they can’t be modified or removed manually, not even by a Subscription Owner. They're automatically created by services like Blueprints, Deployment Stacks, Managed Applications, Resource Guards, or ARO, and they stay in place as long as the related resource exists.

If you get errors like “the client does not have authorization … because a deny assignment was found”, don’t try to remove the deny via the IAM blade—it won’t work. Instead, you need to identify its source:

powershell

Get-AzDenyAssignment | Select DenyAssignmentName,Description,Scope

or

bash

az role assignment list --include-deny-assigned --output table

Check the Description field for clues (e.g., created by Blueprint ‘xyz’, Deployment Stack ‘abc’, etc.). Then go to the portal and remove or modify that resource (e.g., delete the blueprint, change its locking mode, remove the stack, uninstall the managed app, etc.). Once it's gone, Azure will automatically delete the deny assignment and permissions will work again.

If the Scope is a Management Group, you'll need a MG Owner to remove the source, or elevate your access temporarily (Global admin - Elevate access).

Answer 2

@Michele Ariis so, after checking the unusual activity activities on the subscription, we found out that there has been a malicious activity on the subscription. some resources were created some resources which we were trying to remove. but when removing it, the deny assignment error is still coming up. what can we do

Answer 3

Hello @Obafemi Adesanya

Based on the image and your description, the error message shown is not directly related to Azure subscription access, but rather to a synchronization issue in Azure AD Connect (specifically with the proxyAddresses attribute). However, your current issue is likely due to a deny assignment or missing role assignments at the subscription level.

Even if you're the subscription owner, if there's a Deny Assignment in place, it will override all role assignments—even Owner or Contributor.

You mentioned:

"IAM → Deny assignments → it is read-only"

This suggests that the deny assignment might have been created by Microsoft Defender for Cloud, Azure Blueprints, or Policy Initiatives, which can lock down resource creation. This suggests that the deny assignment might have been created by Microsoft Defender for Cloud, Azure Blueprints, or Policy Initiatives, which can lock down resource creation.

1. Check for Active Deny Assignments

Go to Azure Portal → Subscriptions → Your Subscription → Access Control (IAM) → Deny assignments.

If you see a deny assignment from Microsoft Security or Blueprint, it may be locking down resource creation. For further information, please visit this link: https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments?tabs=azure-portal#list-deny-assignments

2. Check Azure Policy Assignments

• Go to Azure Policy → Assignments.
• Look for any policies that deny resource creation or enforce specific conditions.
• Remove or modify the policy if it’s too restrictive.

3. Check Management Group Inheritance

If your subscription is part of a management group, it may be inheriting deny assignments or policies from the parent group.

• Go to Management Groups → Select the parent group → Check IAM and Policy Assignments.

4. Verify Role Assignments

• Ensure users have the correct role assignments (e.g., Contributor, Owner) at the subscription or resource group level.
• Go to IAM → Role assignments and confirm.

Kindly let me know if any of these works for you and please let me know if you have any further questions or need clarifications.

If I have answered your question, please accept this as answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

Best regards,

Megan.