Search code examples
azureazureportalazure-policyazure-rbacazure-security

Impossible to remove Tenant's wide azure policy despite Global administrator role

I am trying to remove an Azure Policy and the delete button is grey out despite my user having Global administrator permission. I can't find any information on Microsoft documentation about the role required. Any idea ?

The policy is on the location available for ressource and forbid the creation of any resource outside a list of location.

enter image description here

Regards

Vincent

Solution

  • The Global Administrator permissions means that you have permissions to manage all aspects of Azure AD, however it does not give you RBAC permissions needed to manage the resources itself (resources, resource groups, subscriptions and management groups).

    You actually need to have RBAC permissions at this management group scope for being able to delete this assignment. If you don´t have any other available account/person with the necessary permissions, you as a Global Administrator has the option to elevated yourself using these steps. It will assign the User Access Administrator role for you at the Tenant Root Group level and then you should be able to delete the assignment.

    Note: Don´t forget to disabled it after finished, as it is a privileged role and you obviously will not want it to remain active, as a best practice for security.