Azure policy for role assignments

Question

Azure policy for role assignments

Ananya Shrivastava 20

Hi @Stanislav Zhelyazkov , i have a question: { "mode": "All", "policyRule": { TypeScriptCopy
```
   "if"
```
Report a concern

Vinod Pittala 1,750 Reputation points Microsoft External Staff Moderator

2025-03-31T07:59:57.53+00:00

Hello Ananya Shrivastava,

Could you please provide more details on the issue or concern you are experiencing? This will help us better understand the situation and offer the most effective solution.

Thanks
Ananya Shrivastava 20 Reputation points

2025-03-31T10:46:46.4666667+00:00

Hi @vinod pittala ,
Oh I see the question did not get posted clearly above. Here is my query:
I am trying to create an Azure policy that blocks the role assignment creation for contributor role scoped to an RG1.
The issue is, for user X, If user X is given contributor role on a parent RG2 or a subscription ( where RG1 and RG2 exists). The role assignment gets propagated to the RG1 as well, which I don't want.
My policy is assigned at RG1, so it stays in compliance even though I have a inherited contributor role assignment for user X.
i want to block the contributor permission on RG1. even though this permission is given at the parent scope.
I know that removing this permission from parent and assigning it to child scopes ( wherever required) can solve this issue. But I don't want to remove permission from parent scope.
Ashok Gandhi Kotnana 6,680 Reputation points Microsoft External Staff Moderator

2025-03-31T13:23:04.4866667+00:00
Hi @Ananya Shrivastava,

To address your scenario, using a Deny Assignment in Azure could be a viable solution. Deny Assignments explicitly block certain actions, even if a user has permissions inherited from a parent scope. Here's how you can approach this:

Create a Deny Assignment: You can define a deny assignment at the RG1 scope to block the "Contributor" role's permissions. This will override any inherited permissions from RG2 or the subscription level.

Define the Scope: Ensure the deny assignment is scoped specifically to RG1. This way, it won't affect permissions at RG2 or the subscription level.

Specify Actions to Deny: In the deny assignment, you can specify the actions you want to block. For example, you can block actions like Microsoft.Resources/subscriptions/resourceGroups/write or other Contributor-level actions.

https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments?tabs=azure-portal#how-deny-assignments-are-created

Please provide your valuable comments.

If the Comment is helpful, please click "Upvote it".
Ananya Shrivastava 20 Reputation points

2025-04-01T05:26:38.9066667+00:00

Hi @Ashok Gandhi Kotnana , I thought of this solution earlier. But what I could see is that there is no direct way to create a deny assignment in Azure. It can only be achieved when you deploy resources through the Deployment Stack.

In my case I am provisioning resources using Terraform. I wont like to change the whole architecture because of the deny assignments. Let me know if there is a way to create Deny assignment in Azure directly via portal/CLI/powershell or terraform.
or if there is any workaround.

Accepted answer

0 additional answers

Your answer

Vinod Pittala 1,750 Reputation points Microsoft External Staff Moderator

2025-03-31T07:59:57.53+00:00

Hello Ananya Shrivastava,

Could you please provide more details on the issue or concern you are experiencing? This will help us better understand the situation and offer the most effective solution.

Thanks
Ananya Shrivastava 20 Reputation points

2025-03-31T10:46:46.4666667+00:00

Hi @vinod pittala ,
Oh I see the question did not get posted clearly above. Here is my query:
I am trying to create an Azure policy that blocks the role assignment creation for contributor role scoped to an RG1.
The issue is, for user X, If user X is given contributor role on a parent RG2 or a subscription ( where RG1 and RG2 exists). The role assignment gets propagated to the RG1 as well, which I don't want.
My policy is assigned at RG1, so it stays in compliance even though I have a inherited contributor role assignment for user X.
i want to block the contributor permission on RG1. even though this permission is given at the parent scope.
I know that removing this permission from parent and assigning it to child scopes ( wherever required) can solve this issue. But I don't want to remove permission from parent scope.
Ashok Gandhi Kotnana 6,680 Reputation points Microsoft External Staff Moderator

2025-03-31T13:23:04.4866667+00:00

Hi @Ananya Shrivastava,

To address your scenario, using a Deny Assignment in Azure could be a viable solution. Deny Assignments explicitly block certain actions, even if a user has permissions inherited from a parent scope. Here's how you can approach this:

Create a Deny Assignment: You can define a deny assignment at the RG1 scope to block the "Contributor" role's permissions. This will override any inherited permissions from RG2 or the subscription level.

Define the Scope: Ensure the deny assignment is scoped specifically to RG1. This way, it won't affect permissions at RG2 or the subscription level.

Specify Actions to Deny: In the deny assignment, you can specify the actions you want to block. For example, you can block actions like Microsoft.Resources/subscriptions/resourceGroups/write or other Contributor-level actions.

https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments?tabs=azure-portal#how-deny-assignments-are-created

Please provide your valuable comments.

If the Comment is helpful, please click "Upvote it".
Ananya Shrivastava 20 Reputation points

2025-04-01T05:26:38.9066667+00:00

Hi @Ashok Gandhi Kotnana , I thought of this solution earlier. But what I could see is that there is no direct way to create a deny assignment in Azure. It can only be achieved when you deploy resources through the Deployment Stack.

In my case I am provisioning resources using Terraform. I wont like to change the whole architecture because of the deny assignments. Let me know if there is a way to create Deny assignment in Azure directly via portal/CLI/powershell or terraform.
or if there is any workaround.

Answer 1

Ashok Gandhi Kotnana 6,680 Microsoft External Staff Moderator

HI @Ananya Shrivastava,

Deny assignments in Azure cannot be created directly through the portal, CLI, or PowerShell. They are managed by Azure and can only be established when deploying resources through a Deployment Stack

But there is an alternate approach other than using Deployment Stack you have an azure blueprint that will do your job, before choosing this refer below screenshot and article

Blueprint further will be used by Deployment stacks you have to do a rework if you are going with blueprint User's image

https://learn.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking
https://learn.microsoft.com/en-us/azure/governance/blueprints/overview

Please provide your valuable comments User's image

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Ananya Shrivastava 20 Reputation points

2025-04-02T05:03:31.94+00:00

Hi @Ashok Gandhi Kotnana , Thanks for the above response.
Yes I can see that deny assignments are only created with deployment stack ultimately, which in my case, will not work. As I am using terraform to provision resources.
In this case, I should remove the existing RBAC assignment from the parent scope. and apply it to child scopes
Vinod Pittala 1,750 Reputation points Microsoft External Staff Moderator

2025-04-02T05:45:51.78+00:00

Hello Ananya Shrivastava,

You are right!
You can remove it from the parent and instead, grant access only at the individual resource levels or to specific resource groups.

Share via

Azure policy for role assignments

0 additional answers

Your answer