Check assignment existence before interpreting an ABAC deletion 403

Source facts

Microsoft documents a conditional-authorization case where deleting a nonexistent or already deleted role assignment returns HTTP 403 instead of the expected 204. The caller’s permission to manage assignments includes an ABAC condition.

Condition evaluation attempts to read an attribute; an absent attribute can produce the unexpected response. Microsoft says the resulting 403 can mean insufficient permission, prior deletion or a target that never existed. Microsoft Learn.

Applicability

Identify the exact assignment ID, requested scope and conditional permission used by the client. Keep this documented deletion case separate from unrelated 403 responses elsewhere in Azure.

DSE recommendation

DSE recommends preserving the original request and checking target state through an authorized read path before deciding what to do next. If the reader also lacks access, keep existence unresolved rather than assuming deletion succeeded. Do not automatically remove the condition or assign a broader role simply to turn the response into a different status code.

Verification

Test the client against an existing assignment, an already removed assignment and a genuinely unauthorized target in a controlled scope. Confirm each outcome is recorded accurately and that ambiguous responses remain actionable. Retain assignment identity and observed state with the response so a retry does not conceal whether the intended access removal actually occurred.

Official references

Microsoft Learn: Troubleshoot Azure role assignment conditions – Azure ABAC. Source retrieved September 9, 2026.