Adding or removing role assignments using Azure Portal

Go back to AZ-304 Tutorials

In this article you will learn about assigning roles using Azure portal and the process of adding and removing role assignments.

However, Azure’s role-based access control (RBAC) refers to the authorization system for managing access to Azure resources. And, to grant access, you assign roles to users, groups, service principals, or managed identities at a particular scope.

Prerequisites

For adding or removing role assignments, you must have:

Firstly, Microsoft.Authorization/roleAssignments/write
Secondly, Microsoft.Authorization/roleAssignments/delete permissions, such as User Access Administrator or Owner

Access control (IAM)

Access control (IAM) is the page that is for assigning roles to grant access to Azure resources. It’s also known as identity and access management and appears in several locations in the Azure portal. There are questions for assigning roles to help in understanding about the Access control (IAM) page.

Who needs access? This refers to a user, group, service principal, or managed identity.
What role do they need? Permissions are grouped together into roles, so you can select from a list of several built-in roles orcan use custom roles.
Where do they need access? This refers to the set of resources that the access applies to. However, “where” can be a management group, subscription, resource group, or a single resource such as a storage account.

Adding a role assignment

Firstly, in the Azure portal, click All services and then select the scope that you want to grant access to.
Secondly, click the specific resource for that scope.
Then, Click Access control (IAM).
Fourthly, click the Role assignments tab for viewing the role assignments at this scope.
After that, click Add > Add role assignment. However, if you don’t have permissions to assign roles, the Add role assignment option will be disabled.

adding role assignments — Image Source: Microsoft

Then, in the Role drop-down list, select a role such as Virtual Machine Contributor.
There in the Select list, select a user, group, service principal, or managed identity. And, if you don’t see the security principal in the list, you can type in the Select box to search the directory for display names, email addresses, and object identifiers.
Lastly, click Save to assign the role.

Assigning a user as an administrator of a subscription

For giving users the role of an administrator of an Azure subscription, first assign them the Owner role at the subscription scope. As the Owner role gives the user full access to all resources in the subscription, including the permission to grant access to others. However, these steps are the same as any other role assignment.

Firstly, in the Azure portal, click All services and then Subscriptions.
Then, click the subscription where you want to grant access.
Thirdly, click Access control (IAM).
After that, click the Role assignments tab to view the role assignments for this subscription.
Then, click Add > Add role assignment. However, if you don’t have permissions to assign roles, the Add role assignment option will be disabled.
And, in the Role drop-down list, select the Owner role.
Then, in the Select list, select a user.
Lastly, click Save to assign the role.

Adding a role assignment for a managed identity

For adding role assignments for a managed identity use the Access control (IAM) page. However, when you use the Access control (IAM) page, you start with the scope and then select the managed identity and role. In this section, you will learn about an alternate way to add role assignments for a managed identity. Using these steps, you start with the managed identity and then select the scope and role.

System-assigned managed identity

Use these steps for assigning a role to a system-assigned managed identity by starting with the managed identity.
Firstly, in the Azure portal, open a system-assigned managed identity. Then, in the left menu, click Identity.

system assign role assignments — Image Source: Microsoft

After that, under Permissions, click Azure role assignments. However, if roles are already assigned to the selected system-assigned managed identity then you will see the list of role assignments.
For changing the subscription, click the Subscription list. Then, click Add role assignment.
Then, use the drop-down lists to select the set of resources that the role assignment applies to such as Subscription, Resource group, or resource. And, if you don’t have role assignment write permissions for the selected scope, an inline message will be displayed.
After that, in the Role drop-down list, select a role such as Virtual Machine Contributor.
Lastly, click Save to assign the role.

User-assigned managed identity

Use these steps for assigning a role to a user-assigned managed identity by starting with the managed identity.
Firstly, in the Azure portal, open a user-assigned managed identity. Then, in the left menu, click Identity.
After that, under Permissions, click Azure role assignments. However, if roles are already assigned to the selected user-assigned managed identity then you will see the list of role assignments.

user assign role assignments — Image Source: Microsoft

For changing the subscription, click the Subscription list. Then, click Add role assignment.
Then, use the drop-down lists to select the set of resources that the role assignment applies to such as Subscription, Resource group, or resource. And, if you don’t have role assignment write permissions for the selected scope, an inline message will be displayed.
After that, in the Role drop-down list, select a role such as Virtual Machine Contributor.
Lastly, click Save to assign the role.

Removing a role assignment

In Azure RBAC, for removing access from an Azure resource, you first remove a role assignment. Use these steps to remove a role assignment.

Firstly, Open Access control (IAM) at a scope, such as management group, subscription, resource group, or resource, where you want to remove access.
Then, click the Role assignments tab to view all the role assignments for this subscription.
After that, in the list of role assignments, add a checkmark next to the security principal with the role assignment you want to remove.
Then, Click Remove.
Lastly, in the remove role assignment message that appears, click Yes.

However, if you see a message that inherited role assignments cannot be removed, then you are trying to remove a role assignment at a child scope. So, you should open Access control (IAM) at the scope where the role was assigned and try again.

Reference: Microsoft Documentation