How to Delete a Role Assignment in Azure using REST API

Question

I am trying to delete a role assignment at the root level in Azure using the REST API. Specifically, I want to remove the Owner role from a user with the email address "[email protected]" I have gathered the object ID of the user and the role definition ID of the Owner role. Now, I'm looking for guidance on how to construct a DELETE request URL.

https://management.azure.com/%7Bscope%7D/providers/Microsoft.Authorization/roleAssignments/%7BroleAssignmentName%7D?api-version=2015-07-01

Could someone provide the correct values to replace scope and roleAssignmentName in this URL to successfully delete the role assignment?

Additional Information:

The {scope} in this case is at the root level, so it should be /. The roleAssignmentName is a GUID that uniquely identifies the role assignment. The API version is specified as api-version=2015-07-01. Any guidance on how to construct the DELETE request URL correctly would be greatly appreciated.

I am trying to delete a role assignment at the root level in Azure using the REST API. Specifically, I want to remove the Owner role from a user with the email address "[email protected]" I have gathered the object ID of the user and the role definition ID of the Owner role. Now, I'm looking for guidance on how to construct a DELETE request URL.

Answer 1

Initially, I generated access token using client credentials flow via Postman for service principal:

POST https://login.microsoftonline.com/tenantId/oauth2/v2.0/token
grant_type:client_credentials
client_id: appId 
client_secret: secret 
scope: https://management.azure.com/.default

Response:

I have one user assigned with Owner role under subscription scope as below:

To get the above role assignment name/ID, you can run below REST API call:

GET https://management.azure.com/subscriptions/subId/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&$filter=principalId eq 'userObjId'
Authorization: Bearer <token>

Response:

Now, run below REST API call to delete the role assignment by including scope and role assignment name:

DELETE https://management.azure.com/subscriptions/subId/providers/Microsoft.Authorization/roleAssignments/roleassignment_name?api-version=2022-04-01
Authorization: Bearer <token>

Response:

When I checked the same in Portal, role assignment deleted successfully as below:

Response: Role Assignments - Delete - REST API (Azure Authorization) | Microsoft