Storage account Disable inheritance

viji.e 96 Reputation points
2021-05-03T12:50:41.577+00:00

I have created a storage account with hierarchical namespace enabled and by default it inherits the role assignments from subscription and resource group level. If User/Group is added to the subscription/resource group, they are automatically added to IAM of storage acccount. But we want to control this. Can you please let me know how we can disable this inheritance?
93305-storage-account-inheritance.png

Azure Data Lake Storage
Azure Data Lake Storage
An Azure service that provides an enterprise-wide hyper-scale repository for big data analytic workloads and is integrated with Azure Blob Storage.
1,270 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. MartinJaffer-MSFT 25,986 Reputation points
    2021-05-03T17:06:04.36+00:00

    Hello @viji.e and welcome to Microsoft Q&A.

    While you cannot "turn off" inheritance, you can use "Deny Assignments" to block it. Please read more about Deny Assignments here.

    93411-image.png

    0 comments No comments

  2. viji.e 96 Reputation points
    2021-05-03T17:52:33.443+00:00

    @MartinJaffer-MSFT , I had already gone through the link and didn't find it useful. It doesn't say how to create Azure Blueprints for Deny Assignments. Can you share the steps on how to create deny assignments using Azure Blueprint?