Azure blueprints deny inherted roles to storage account

Question

We have a storage account that contains sensitive info. We need to remove certain groups that have inherited access. (the dev group for example) If I select the group and try to "Remove" the group from the storage account it tells me "Inherited role assignments cannot be removed" When I go to Deny assignments page it says that I need to use Azure Blueprints to add a rule. I'm struggling with building the right blueprint to remove access.

Can you give me an example blueprint that would accomplish this or if there is a better method for making this happen. I'm open to anyway to deny select inherited groups. Thanks.

Answer 1

@Nick T Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

Blueprints is not a tool to create deny assignments. Instead, Deny assignments are a feature that the Blueprints service uses to leverage its own functionality.

Blueprints can only lock resources that a blueprint creates, in a do not delete or read only fashion, so it won't cover this requirement

Azure doesn't offer functionality for users to create their own custom deny assignments

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and wherever the information provided helps you, this can be beneficial to other community members.