Need to remove system protected deny assignment

Question

Need to remove system protected deny assignment

Cindy Noteboom 0 Microsoft Employee

I am trying to cancel a subscription but am unable to do so because I cannot delete all of the resources because of deny assignements that have been applied. The deny assignment is system protected and according to documentation, only microsoft can delete a system protected deny assignment.

Note, there are no tags or child tags available for this request. Making it extremely difficult to get to the correct support/help queue.

Suchitra Suregaunkar 3,540 Reputation points Microsoft External Staff Moderator

2025-12-03T20:21:35.3266667+00:00

Hello Cindy Noteboom

Thank you for posting your query on Microsoft Q&A platform.

Azure deny assignments are created and managed by Azure to protect certain resources. When the property isSystemProtected is true, the deny cannot be edited or deleted by customers even Subscription Owners. These denies commonly come from service‑managed artifacts such as Managed Applications, Databricks workspaces (managed resource groups), Deployment Stacks, Synapse/Container Apps helpers, etc.

Try below resolution steps:

A) Remove the originating service/artifact:

Identify what created the deny and delete that parent (the deny is removed automatically).

Managed Applications: delete the Managed Application instance first, this clears the deny so the RG/resources can be deleted.

Azure Databricks: delete the Databricks workspace, this cleans up the managed resource group and its system deny. If the managed RG remains, treat it as orphaned and proceed to Support.

Deployment Stacks/other service‑managed RGs: update/delete the stack/service that owns the deny, then retry deletion.

To identity go to azure Portal: at the failing scope (subscription/RG/resource) → Access control (IAM) → Deny assignments. The Description/Scope usually points to the creating service (e.g., “created by Azure Databricks workspace …”).

To List Azure RBAC deny assignments at the specified scope, refer below document:

https://learn.microsoft.com/en-us/powershell/module/az.resources/get-azdenyassignment?view=azps-15.1.0

B) If the deny is orphaned (parent already gone) or still blocks cleanup

Open a Microsoft Support request and ask for removal of a system‑protected deny assignment blocking deletion/cancellation. This scenario is recognized and routinely handled by support when a service leaves a protected deny behind.

After deny is cleared delete the remaining resources/resource groups, then cancel the subscription from Cost Management & Billing → Subscriptions → Cancel.

Thanks,

Suchitra.

1 answer

Your answer

Answer 1

Q&A Assist

AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

You are correct that system protected deny assignments cannot be deleted or modified by users. These deny assignments are managed by Microsoft, and only they have the ability to remove them. If you are facing issues with a deny assignment that is preventing you from canceling your subscription, you will need to contact Microsoft support for assistance. They will be able to review your situation and provide guidance on how to proceed.

References:

Share via

Need to remove system protected deny assignment

1 answer

Your answer