Azure Documentation

1. User Cannot Access Resources They Should Have Access To

This is a frequent issue. The most common reasons are:

• Propagation Delay: Role assignments can take a few minutes to propagate across Azure. Wait for a short period and try again.
• Incorrect Scope: The role assignment might be at a higher scope (e.g., subscription level) than the resource the user is trying to access. Ensure the role is assigned at the resource group or resource level if needed.
• Wrong Role Assigned: The assigned role might not have the necessary permissions for the specific action. Verify the permissions granted by the role against the required actions.
• Overlapping Deny Assignments: Deny assignments can override allow assignments. Check for any active deny assignments that might be blocking access.
• Guest User Permissions: If the user is a guest from another Azure AD tenant, ensure their B2B collaboration settings are correctly configured and they have been invited with the appropriate permissions.

Troubleshooting Steps:

1. Verify the role assignment details in the Azure portal (Azure Active Directory -> Roles and administrators -> Roles, or the resource's Access control (IAM) blade).
2. Check the scope of the assignment.
3. Confirm the user's identity and tenant.
4. Review the permissions included in the assigned role.
5. Look for any Deny Assignments that might be in effect using Azure Policy or RBAC management tools.

2. User Has More Permissions Than Intended

Granting excessive permissions is a security risk. If a user has broader access than required, it's often due to:

• Broadly Defined Roles: Using built-in roles like "Owner" or "Contributor" at a high scope when a more specific custom role or a less privileged built-in role would suffice.
• Multiple Role Assignments: A user might have several role assignments across different scopes that collectively grant more permissions than intended.

Troubleshooting Steps:

1. Principle of Least Privilege: Always assign the minimum permissions necessary for a user to perform their job.
2. Custom Roles: Consider creating custom roles that precisely define the required permissions.
3. Scope Review: Regularly audit role assignments and their scopes to ensure they are still appropriate.
4. Built-in Role Selection: Carefully choose the most appropriate built-in role. For example, use "Reader" for read-only access, "Storage Blob Data Contributor" for specific blob operations, etc.

3. Issues with Custom Role Assignments

Custom roles offer granular control but can be complex to set up correctly.

• JSON Syntax Errors: Ensure the custom role definition JSON is valid.
• Incorrect Permissions: The `actions`, `notActions`, `dataActions`, or `notDataActions` might be incorrectly specified.
• Scope Limitations: Custom roles can only grant permissions that are available at the scope they are assigned to.

Troubleshooting Steps:

1. Validate JSON: Use a JSON validator to check the syntax of your custom role definition file.
2. Permission Reference: Consult the Azure documentation for a complete list of available permissions for different services.
3. Test Incrementally: Start with a minimal set of permissions and add more as needed, testing after each addition.
4. Azure CLI/PowerShell: Use commands like `az role definition list` and `az role assignment create` for scripting and validation.

Example of a simple custom role definition (JSON):

{
    "Name": "Virtual Machine Reader",
    "IsCustom": true,
    "Description": "Can read virtual machine properties.",
    "Actions": [
        "Microsoft.Compute/virtualMachines/read"
    ],
    "NotActions": [],
    "DataActions": [],
    "NotDataActions": [],
    "AssignableScopes": [
        "/subscriptions/YOUR_SUBSCRIPTION_ID"
    ]
}
                

4. Deny Assignments Affecting Access

Deny assignments prevent specific Azure RBAC actions, even if a role assignment would otherwise allow them. These are typically created by Azure Policy.

• Policy Enforcement: A policy might be assigning a deny assignment to prevent certain operations (e.g., deleting resources, modifying network security groups).
• Built-in Deny Assignments: Some Azure services might have implicit deny assignments.

Troubleshooting Steps:

1. Check Azure Policy: Navigate to Azure Policy in the portal and review the "Deny assignments" section. Identify policies that might be causing the restriction.
2. Resource Group/Subscription Level: Deny assignments are often applied at higher scopes.
3. Understand Policy Effects: Understand what specific actions the deny assignment is blocking.
4. Policy Remediation: If the deny assignment is incorrect, you may need to modify or disable the associated Azure Policy.