How to remove a 'dangling' Access Control (IAM) assignment for User Access Administrator?

Joe MacPherson 0 Reputation points
2024-05-17T15:59:28.9133333+00:00

A User profile was set as User Access Administrator, the mistake was recognized, and the User profile was deleted... However, after the deletion, there is a 'dangling' Access Control (IAM) entry indicating ("Identity not found") which makes sense as the profile no longer exists. The online documentation, (https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal#remove-a-role-assignment-at-the-root-scope-), indicates to login as the User which executed the elevated permissions command. We attempted to re-add the User Profile to revoke the User Access Administrator assignment which did not work, because the original Object ID for the User Profile no longer exists...
Is there a way to remove this entry? I'm pretty confident that the profile is not a danger, just a nuisance cleanup event...

User's image

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,947 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Andy David - MVP 142.9K Reputation points MVP
    2024-05-17T16:11:14.34+00:00

    it says sign in as any user that can remove elevated access, not necessarily the user who initially added that account :)

    1. Sign in as a user that can remove elevated access. This can be the same user that was used to elevate access or another Global Administrator with elevated access at root scope.
    2. Use the Remove-AzRoleAssignment command to remove the User Access Administrator role assignment. Azure PowerShellCopy
    3. Remove-AzRoleAssignment -SignInName username@example.com -RoleDefinitionName "User Access Administrator" -Scope "/"
         
      

  2. Joe MacPherson 0 Reputation points
    2024-05-17T22:13:06.1566667+00:00

    Hey Andy - Thanks for the support...
    Unfortunately, just keep getting different blockers...
    Error response - Invalid status code 'forbidden'
    User's image

    0 comments No comments