{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/", "slug": "dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role", "url": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/" }, "title": "Include eligible assignments when retiring an Azure custom role", "summary": "A role definition cannot be deleted while assignments still reference it, including eligible PIM assignments.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:35+00:00", "modified_at": "2026-09-10T02:01:56+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 228, "potentially_affected": "Azure custom-role retirement across the role's assignable scopes, including PIM-managed access.", "dse_recommendation": "Inventory active and eligible references across every assignable scope before approving role retirement.", "primary_source": { "name": "Azure custom roles - Azure RBAC | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure rejects deletion of a custom role that still has referencing assignments with RoleDefinitionHasAssignments. Microsoft’s retirement procedure enumerates the role’s AssignableScopes, removes referencing assignments and explicitly includes eligible custom-role assignments in PIM before deleting the definition.

\n

Renaming a role does not change its role ID. Microsoft recommends using that stable ID in assignment automation instead of relying on the role name. Microsoft Learn.

\n

Applicability

\n

Identify the exact role ID, all assignable scopes and the administrators responsible for active and eligible access. This is a retirement review, not authorization to remove every discovered assignment immediately.

\n

DSE recommendation

\n

DSE recommends preparing a reference inventory and replacement-access decision before deletion. Confirm which users or automation still require the role and obtain approval for their transition. Include eligible PIM entries even when no activation is currently visible. Use the role ID to avoid confusing a renamed definition with another similarly named role.

\n

Verification

\n

After approved assignment transitions, repeat the reference inventory across the identified scopes. If deletion remains blocked, preserve the error and investigate remaining references instead of broadening the deletion target. Verify that intended replacement access still works and unintended access is absent. Retain the retired role definition and approvals as change evidence without claiming that a successful delete alone proves the access migration was safe.

\n

Official references

\n

Microsoft Learn: Azure custom roles – Azure RBAC. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure rejects deletion of a custom role that still has referencing assignments with RoleDefinitionHasAssignments. Microsoft’s retirement procedure enumerates the role’s AssignableScopes, removes referencing assignments and explicitly includes eligible custom-role assignments in PIM before deleting the definition.\nRenaming a role does not change its role ID. Microsoft recommends using that stable ID in assignment automation instead of relying on the role name. Microsoft Learn.\nApplicability\nIdentify the exact role ID, all assignable scopes and the administrators responsible for active and eligible access. This is a retirement review, not authorization to remove every discovered assignment immediately.\nDSE recommendation\nDSE recommends preparing a reference inventory and replacement-access decision before deletion. Confirm which users or automation still require the role and obtain approval for their transition. Include eligible PIM entries even when no activation is currently visible. Use the role ID to avoid confusing a renamed definition with another similarly named role.\nVerification\nAfter approved assignment transitions, repeat the reference inventory across the identified scopes. If deletion remains blocked, preserve the error and investigate remaining references instead of broadening the deletion target. Verify that intended replacement access still works and unintended access is absent. Retain the retired role definition and approvals as change evidence without claiming that a successful delete alone proves the access migration was safe.\nOfficial references\nMicrosoft Learn: Azure custom roles – Azure RBAC. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure rejects deletion of a custom role that still has referencing assignments with RoleDefinitionHasAssignments. Microsoft’s retirement procedure enumerates the role’s AssignableScopes, removes referencing assignments and explicitly includes eligible custom-role assignments in PIM before deleting the definition.\n\nRenaming a role does not change its role ID. Microsoft recommends using that stable ID in assignment automation instead of relying on the role name. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles).\n\n## Applicability\n\nIdentify the exact role ID, all assignable scopes and the administrators responsible for active and eligible access. This is a retirement review, not authorization to remove every discovered assignment immediately.\n\n## DSE recommendation\n\nDSE recommends preparing a reference inventory and replacement-access decision before deletion. Confirm which users or automation still require the role and obtain approval for their transition. Include eligible PIM entries even when no activation is currently visible. Use the role ID to avoid confusing a renamed definition with another similarly named role.\n\n## Verification\n\nAfter approved assignment transitions, repeat the reference inventory across the identified scopes. If deletion remains blocked, preserve the error and investigate remaining references instead of broadening the deletion target. Verify that intended replacement access still works and unintended access is absent. Retain the retired role definition and approvals as change evidence without claiming that a successful delete alone proves the access migration was safe.\n\n## Official references\n\n[Microsoft Learn: Azure custom roles – Azure RBAC](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/", "url": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Include eligible assignments when retiring an Azure custom role", "item": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/", "url": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/", "headline": "Include eligible assignments when retiring an Azure custom role", "description": "A role definition cannot be deleted while assignments still reference it, including eligible PIM assignments.", "abstract": "A role definition cannot be deleted while assignments still reference it, including eligible PIM assignments.", "articleBody": "Source facts\nAzure rejects deletion of a custom role that still has referencing assignments with RoleDefinitionHasAssignments. Microsoft’s retirement procedure enumerates the role’s AssignableScopes, removes referencing assignments and explicitly includes eligible custom-role assignments in PIM before deleting the definition.\nRenaming a role does not change its role ID. Microsoft recommends using that stable ID in assignment automation instead of relying on the role name. Microsoft Learn.\nApplicability\nIdentify the exact role ID, all assignable scopes and the administrators responsible for active and eligible access. This is a retirement review, not authorization to remove every discovered assignment immediately.\nDSE recommendation\nDSE recommends preparing a reference inventory and replacement-access decision before deletion. Confirm which users or automation still require the role and obtain approval for their transition. Include eligible PIM entries even when no activation is currently visible. Use the role ID to avoid confusing a renamed definition with another similarly named role.\nVerification\nAfter approved assignment transitions, repeat the reference inventory across the identified scopes. If deletion remains blocked, preserve the error and investigate remaining references instead of broadening the deletion target. Verify that intended replacement access still works and unintended access is absent. Retain the retired role definition and approvals as change evidence without claiming that a successful delete alone proves the access migration was safe.\nOfficial references\nMicrosoft Learn: Azure custom roles – Azure RBAC. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:25:35+00:00", "dateModified": "2026-09-10T02:01:56+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-381-include-eligible-assignments-when-retiring-an-azure-custom-role/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Include eligible assignments when retiring an Azure custom role" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 228, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure custom roles - Azure RBAC | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles" } } ] } }