Remove Azure role assignments

To remove role assignments, you must have:

• Microsoft.Authorization/roleAssignments/delete permissions, such as Role Based Access Control Administrator

For the REST API, you must use the following version:

• 2015-07-01 or later

For more information, see API versions of Azure RBAC REST APIs.

Follow these steps:

1. Open Access control (IAM) at a scope, such as management group, subscription, resource group, or resource, where you want to remove access.

2. Click the Role assignments tab to view all the role assignments at this scope.

3. In the list of role assignments, add a checkmark next to the security principal with the role assignment you want to remove.

   

4. Click Remove.

   

5. In the remove role assignment message that appears, click Yes.

   If you see a message that inherited role assignments cannot be removed, you are trying to remove a role assignment at a child scope. You should open Access control (IAM) at the scope where the role was assigned and try again. A quick way to open Access control (IAM) at the correct scope is to look at the Scope column and click the link next to (Inherited).

   

In Azure PowerShell, you remove a role assignment by using Remove-AzRoleAssignment.

The following example removes the Virtual Machine Contributor role assignment from the patlong@contoso.com user on the pharma-sales resource group:

In Azure CLI, you remove a role assignment by using az role assignment delete.

The following example removes the Virtual Machine Contributor role assignment from the patlong@contoso.com user on the pharma-sales resource group:

In the REST API, you remove a role assignment by using Role Assignments - Delete.

1. Get the role assignment identifier (GUID). This identifier is returned when you first create the role assignment or you can get it by listing the role assignments.

2. Start with the following request:

   DELETE https://management.azure.com/{scope}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}?api-version=2022-04-01
   

3. Within the URI, replace {scope} with the scope for removing the role assignment.

   Scope	Type
   providers/Microsoft.Management/managementGroups/{groupId1}	Management group
   subscriptions/{subscriptionId1}	Subscription
   subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1	Resource group
   subscriptions/{subscriptionId1}/resourceGroups/myresourcegroup1/providers/microsoft.web/sites/mysite1	Resource

4. Replace {roleAssignmentId} with the GUID identifier of the role assignment.

   The following request removes the specified role assignment at subscription scope:

   DELETE https://management.azure.com/subscriptions/{subscriptionId1}/providers/microsoft.authorization/roleassignments/{roleAssignmentId1}?api-version=2022-04-01
   

   The following shows an example of the output:

   {
       "properties": {
           "roleDefinitionId": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleDefinitions/a795c7a0-d4a2-40c1-ae25-d81f01202912",
           "principalId": "{objectId1}",
           "principalType": "User",
           "scope": "/subscriptions/{subscriptionId1}",
           "condition": null,
           "conditionVersion": null,
           "createdOn": "2022-05-06T23:55:24.5379478Z",
           "updatedOn": "2022-05-06T23:55:24.5379478Z",
           "createdBy": "{createdByObjectId1}",
           "updatedBy": "{updatedByObjectId1}",
           "delegatedManagedIdentityResourceId": null,
           "description": null
       },
       "id": "/subscriptions/{subscriptionId1}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId1}",
       "type": "Microsoft.Authorization/roleAssignments",
       "name": "{roleAssignmentId1}"
   }
   

   ARM template

   There isn't a way to remove a role assignment using an Azure Resource Manager template (ARM template). To remove a role assignment, you must use other tools such as the Azure portal, Azure PowerShell, Azure CLI, or REST API.