Remove Deny Assignment on Resource

Question

Remove Deny Assignment on Resource

Eric Chen 0 Microsoft Employee

A resource group belonging to a team member has left and I need to delete their RG (and associated resources). I am the owner of this subscription, but I cannot seem to delete this deny assignment. How can I resolve this?

Suchitra Suregaunkar 14,595 Reputation points Microsoft External Staff Moderator

2026-03-10T18:58:49.9533333+00:00

Hello @Eric Chen

Thank you for reaching out to the Microsoft Q&A forum.

We are looking into your issue and will keep you posted updates.

Thanks,
Suchitra.
Suchitra Suregaunkar 14,595 Reputation points Microsoft External Staff Moderator

2026-03-10T19:17:10.45+00:00
Hello @Eric Chen

Even though you are the Owner of the subscription, you cannot remove or bypass a Deny Assignment. Deny assignments are evaluated before RBAC roles and override all permissions, including Owner.

Deny assignments cannot be manually created or removed by users

They are system‑managed and are created automatically by Azure when using certain features, such as:

Azure Blueprints

Deployment Stacks

Managed Applications

Some Azure services (for example: OpenShift, AKS, Synapse, Azure Learn modules)

Only the Azure service or managed identity that created the deny assignment is allowed to remove it. Subscription Owners do not have the ability to delete deny assignments directly.

Identify what created the deny assignment:

Go to: Resource Group → Access control (IAM) → Deny assignments

Check the Description / Created by / Scope fields. This will indicate whether the deny assignment was created by:

A Blueprint assignment

A Deployment Stack

A Managed Application

Another Azure service

You must remove the source that created the deny assignment.

Once the parent object is removed, Azure automatically removes the deny assignment, and the resource group can then be deleted.

Reference: https://docs.azure.cn/en-us/role-based-access-control/deny-assignments?tabs=azure-portal#how-deny-assignments-are-created

Thanks,

Suchitra.

1 answer

Your answer

Suchitra Suregaunkar 14,595 Reputation points Microsoft External Staff Moderator

2026-03-10T18:58:49.9533333+00:00

Hello @Eric Chen

Thank you for reaching out to the Microsoft Q&A forum.

We are looking into your issue and will keep you posted updates.

Thanks,
Suchitra.
Suchitra Suregaunkar 14,595 Reputation points Microsoft External Staff Moderator

2026-03-10T19:17:10.45+00:00

Hello @Eric Chen

Even though you are the Owner of the subscription, you cannot remove or bypass a Deny Assignment. Deny assignments are evaluated before RBAC roles and override all permissions, including Owner.

Deny assignments cannot be manually created or removed by users

They are system‑managed and are created automatically by Azure when using certain features, such as:

Azure Blueprints

Deployment Stacks

Managed Applications

Some Azure services (for example: OpenShift, AKS, Synapse, Azure Learn modules)

Only the Azure service or managed identity that created the deny assignment is allowed to remove it. Subscription Owners do not have the ability to delete deny assignments directly.

Identify what created the deny assignment:

Go to: Resource Group → Access control (IAM) → Deny assignments

Check the Description / Created by / Scope fields. This will indicate whether the deny assignment was created by:

A Blueprint assignment

A Deployment Stack

A Managed Application

Another Azure service

You must remove the source that created the deny assignment.

Once the parent object is removed, Azure automatically removes the deny assignment, and the resource group can then be deleted.

Reference: https://docs.azure.cn/en-us/role-based-access-control/deny-assignments?tabs=azure-portal#how-deny-assignments-are-created

Thanks,

Suchitra.

Answer 1

Eric Chen 0 Microsoft Employee

Figured it out - It looks like the RG was created through a managed service, hence the deny assignment. It might have been a dangling RG as the parent and resources were not showing in the Overview section of the RG. I tracked down the parent managed service (which was a synapse workspace) and deleted that (which also deleted the RG in question).

0 comments

Share via

Remove Deny Assignment on Resource

1 answer

Your answer