Reduce Azure role-assignment counts without preserving excessive scope

Source facts

Azure’s subscription limit is 4,000 role assignments across subscription, resource-group and resource scopes. Management-group assignments are outside that count, as are eligible assignments and assignments scheduled for the future. Microsoft says the limit cannot be increased.

Microsoft’s cleanup guidance says a higher-scope assignment can grant more access than needed and may be the assignment to remove. Its sample queries return only readable assignments, and the redundant-assignment query omits eligible PIM assignments. Microsoft Learn.

Applicability

Identify the subscription, reviewing identity and actual access required by each principal. Keep active-count reduction separate from a complete privileged-access review.

DSE recommendation

DSE recommends comparing overlapping assignments against a concrete list of required operations and scopes. Prefer removing the unnecessary grant even when that is the broader one. Review query visibility and eligible access before declaring an assignment unused or a principal fully understood. Record the selected removal, the access intentionally retained and the responsible owner before applying any change.

Verification

Recount the relevant assignments after an approved cleanup and test the intended operations with the affected identity. Include a negative check for access that should no longer exist. Retain the scopes and timing represented by the query so another reviewer can reproduce the result. A reduced count should not be accepted as success if it silently preserves excessive access or removes an operation the owner still requires.

Official references

Microsoft Learn: Troubleshoot Azure RBAC limits – Azure RBAC. Source retrieved September 9, 2026.