Search code examples
azureazure-rm-template

How can i put Deny Assignment in Azure Subscription or Resource Group level?

I want to put a Deny Rule on the subscription so that the contributor access can be overridden with the custom role with some exceptions.

I found the article on MS portal ( https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments ), though not able to get any example how this can be implemented.

Any guidance will be helpful.

Thanks

Solution

  • You need to use the Azure Blueprints, you can't directly create your own deny assignments, deny assignments are created and managed by Azure, e.g. Azure Blueprints.

    The doc explains that:

    Deny assignments are created and managed by Azure to protect resources. For example, Azure Blueprints and Azure managed apps use deny assignments to protect system-managed resources. For more information, see Protect new resources with Azure Blueprints resource locks.