Azure RBAC Enforcement and Service Administration Retirement

Hi Void,

Thank you for reacing out. Please do remember to mark this answer.

https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators

Yes, that's correct. Starting April 30, 2025, the legacy Service Administrator and Co-Service Administrator roles in Azure will be retired12. This means any role assignments for these positions will lose access after this date1.

To avoid disruptions, it's important to transition these roles to Azure Role-Based Access Control (RBAC) roles. The Owner role at the subscription scope is the equivalent role for both Service Administrator and Co-Service Administrator12. Azure RBAC offers more granular access control and compatibility with Microsoft Entra Privileged Identity Management (PIM)1

Regards

M

Hello @void

Answering to your concern: 1. Can I keep both RBAC Owner and the legacy Service Administrator role for now? Yes, you can still keep both the RBAC Owner and the legacy Service Administrator roles for now. As of the email notification, Microsoft has announced that the legacy roles (Service Administrator and Co-Service Administrator) will be retired after April 30, 2025. This is a modern role that is part of Azure's RBAC, which provides similar permissions to the legacy Service Administrator role but within the context of Azure's modern security model. As the RBAC Owner, you will have full access and control over the subscription.

If you continue to hold this role, it will still function until the specified date (April 30, 2025). However, after this date, it will be retired, and the permissions associated with it will no longer be available.

2. What will happen if I don't remove the Service Administrator role before 2025/April/30?
After April 30, 2025, the legacy Service Administrator role will no longer be functional. If you haven't removed it, it won't have any effect, but it might be confusing since it will no longer be a valid role.

To avoid potential issues or confusion after the retirement date, it's a good idea to remove the legacy Service Administrator role and rely solely on the RBAC Owner role, which will continue to function.

You can use an Azure Portal or Resource Graph query to list subscriptions with Service Administrator or Co-Administrator role assignments.

Follow these steps to list the Service Administrator and Co-Administrators for a subscription using the Azure portal.

• Sign in to the Azure portal as an Owner of a subscription.
• Open Subscriptions and select a subscription.
• Select Access control (IAM).
• Select the Classic administrators tab to view a list of the Co-Administrators.

Remove Co-Administrators that no longer need access

• If user is no longer in your enterprise, remove Co-Administrator.
• If user was deleted, but their Co-Administrator assignment wasn't removed, remove Co-Administrator.

Users that have been deleted typically include the text (User was not found in this directory).

• After reviewing activity of user, if user is no longer active, remove Co-Administrator.

https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators?tabs=azure-portal#list-classic-administrators

How to remove a Co-Administrator

Follow these steps to remove a Co-Administrator.

Sign in to the Azure portal as an Owner of a subscription.

Open Subscriptions and select a subscription.

Select Access control (IAM).

Select the Classic administrators tab to view a list of the Co-Administrators.

Add a check mark next to the Co-Administrator you want to remove.

Select Delete.

In the message box that appears, select Yes.

I suggest you go through the below document for further reference.

https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators?tabs=azure-portal#how-to-remove-a-co-administrator

Please refer the below FAQs

https://learn.microsoft.com/en-us/azure/role-based-access-control/classic-administrators?tabs=azure-portal#frequently-asked-questions

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/deployment-models

I hope this clarifies things.

Please remember to "Accept Answer", so that others in the community facing similar issues can easily find the answers.