Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
The role assignment with ID
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 88%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDC%3C/text%3E%3C/svg%3E)
Dave Campbell
20
Reputation points
The role assignment with ID <ID> does not exist in PIM. Editing assignment type is not permitted. This is only showing on 1 of our subscriptions under Access control (IAM) > Role Assignments but cannot find the ID that it references anywhere on the Azure side or in PIM (Entra ID). Have looked through audit logs on both PIM and Azure side and have not found the ID referenced so far. Can the forum suggest any other ways to find more detail on this?
Microsoft Security | Microsoft Entra | Microsoft Entra ID
-
Dave Campbell 20 Reputation points
2025-11-25T09:35:38.54+00:00 Found the role ID using az role assignment list and discovered 2 assignments for service principles that didn't exist. Removed these and error message disappeared.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 99%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Rukmini 43,915 Reputation points Microsoft External Staff Moderator2025-11-25T09:53:50.27+00:00 Hello Dave Campbell,
This issue occurs when the role assignment displayed in Azure IAM is corrupted or orphaned. The backend RBAC object has been deleted or only partly removed, therefore:
- Azure IAM continues to display the assignment.
- PIM is unable to locate it.
- The ID is not visible in logs or Graph.
- The assignment type cannot be modified.
It impacts just one subscription since only the RBAC record for that subscription is damaged.
- Try to delete by passing the ID:
az role assignment delete --ids <ID> - If it still fails, try to delete by using the below:
az role assignment delete --assignee <principalId> --role "<roleName>" --scope /subscriptions/<subscriptionId>Once removed, refresh the IAM blade — the corrupted entry vanishes and you can recreate the role assignment as usual.
Let me know if any further queries - feel free to reach out!
Sign in to comment
Sign in to answer