How to give full Azure admin access to my CTO

Question

Hi, I am having trouble giving my CTO full access to everything in Azure, which results in random situations where I am personally required to sign in just to change a setting. We have already tried giving ownership permissions everywhere we find them, but I must be missing something and would appreciate guidance.

Answer 1

Please check whether the access is provided at the root level and there are no role inheritance blocks, Have a look at the detailed steps below.

1. Assign the Correct Role at the Root Level

Azure follows a Role-Based Access Control (RBAC) model, where permissions are inherited down the hierarchy. Ensure your CTO is granted Owner access at the root management group or subscription level.

Steps:

1. Go to the Azure Portal > Management Groups or Subscriptions.
2. Select the root management group (or the appropriate subscription).
3. Navigate to Access Control (IAM) > Add Role Assignment.
4. Assign the Owner role to your CTO’s user account.

This ensures they have complete permissions, which flow down to all resources unless explicitly denied.

---

2. Check for Role Inheritance Blocks

Sometimes, permissions are blocked at lower resource levels, which can override inherited roles.

Steps to Verify:

1. Go to the problematic resource (e.g., a VM, Storage Account).
2. Under Access Control (IAM), check for any Deny Assignments or custom role overrides.
3. Remove or adjust any restrictions that might block inherited permissions.

Please mark this as an Answer if this helps solve your problem.