# Reconcile remediation permissions after changing an Azure Policy definition

> Editing roleDefinitionIds does not automatically update the existing assignment identity's grants.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:26:02+00:00
- Modified: 2026-09-10T02:01:55+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Editing roleDefinitionIds does not automatically update the existing assignment identity's grants.

## Potentially affected

Azure Policy assignments using deployIfNotExists or modify remediation.

## DSE recommendation

Compare revised role requirements with actual identity grants before retrying remediation.

## Article

## Source facts

Azure Policy remediation uses the managed identity associated with the assignment to deploy or modify resources. A policy definition lists required roles in roleDefinitionIds, but changing that definition does not automatically update the assignment or its associated identity.

The portal can grant required roles when creating the identity. Later edits to roleDefinitionIds still require manually granting the new permissions, even when using the portal. SDK-created assignments and resources accessed outside the assignment scope are additional cases requiring manual permission review. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources).

## Applicability

Identify the exact assignment, its identity, the revised policy definition and every resource scope involved. Treat a compliance evaluation and the permission to perform remediation as separate observations.

## DSE recommendation

DSE recommends including an identity-grant comparison in policy-definition change review. Explain each added permission and grant only the necessary scope through the authorized access process. Do not repeatedly rerun remediation or grant broad ownership merely because the updated definition lists a role that the identity does not actually possess.

## Verification

For an approved representative resource, inspect the identity’s effective assignments and run a bounded remediation. Compare deployment or modification results with the revised requirement. Retain the policy revision, identity identifier, grant scope and outcome together. Verify the intended resource state afterward rather than accepting a successful access change as proof that remediation completed.

## Official references

[Microsoft Learn: Remediate non-compliant resources](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources). Source retrieved September 9, 2026.

## Primary reference

- Name: Remediate non-compliant resources - Azure Policy | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Reconcile remediation permissions after changing an Azure Policy definition,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-354-reconcile-remediation-permissions-after-changing-an-azure-policy-definition/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.