How to give full Azure admin access to my CTO

Question

How to give full Azure admin access to my CTO

Akil Bhagat 20

Hi, I am having trouble giving my CTO full access to everything in Azure, which results in random situations where I am personally required to sign in just to change a setting. We have already tried giving ownership permissions everywhere we find them, but I must be missing something and would appreciate guidance.

Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2024-12-19T18:51:09.6566667+00:00

Hi @Akil Bhagat •
Following up to see if the below suggestion was helpful. And, if you have any further query do let us know.
Akil Bhagat 20 Reputation points

2024-12-19T20:09:41.8+00:00

This worked, thank you!

Answer accepted by question author

0 additional answers

Your answer

Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2024-12-19T18:51:09.6566667+00:00

Hi @Akil Bhagat •
Following up to see if the below suggestion was helpful. And, if you have any further query do let us know.
Akil Bhagat 20 Reputation points

2024-12-19T20:09:41.8+00:00

This worked, thank you!

Answer 1

Please check whether the access is provided at the root level and there are no role inheritance blocks, Have a look at the detailed steps below.

Assign the Correct Role at the Root Level

Azure follows a Role-Based Access Control (RBAC) model, where permissions are inherited down the hierarchy. Ensure your CTO is granted Owner access at the root management group or subscription level.

Steps:

Go to the Azure Portal > Management Groups or Subscriptions.
Select the root management group (or the appropriate subscription).
Navigate to Access Control (IAM) > Add Role Assignment.
Assign the Owner role to your CTO’s user account.

This ensures they have complete permissions, which flow down to all resources unless explicitly denied.

Check for Role Inheritance Blocks

Sometimes, permissions are blocked at lower resource levels, which can override inherited roles.

Steps to Verify:

Go to the problematic resource (e.g., a VM, Storage Account).
Under Access Control (IAM), check for any Deny Assignments or custom role overrides.
Remove or adjust any restrictions that might block inherited permissions.

Please mark this as an Answer if this helps solve your problem.