RoleDefinitionLimitExceeded in microsoft.com tenant

Question

RoleDefinitionLimitExceeded in microsoft.com tenant

Asaf Arnon 0 Microsoft Employee

I got RoleDefinitionLimitExceeded when trying to create a new custom role in subscription HLSReportGeneration-Dev in tenant microsoft.com.

Can someone please check orphaned custom roles and delete them ?

Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-03T17:12:31.8566667+00:00

Hello @Asaf Arnon
As per the public documentation, it appears that you’ve exceeded the custom role definition limit in your tenant.

Could you please confirm how many custom role definitions currently exist in your tenant? To retrieve this information, you can run the query mentioned in the following Microsoft documentation: Troubleshoot Azure RBAC limits

Due to the limitation on the number of custom roles in Azure RBAC (Azure custom roles - Azure RBAC), the recommended approach is to delete any unused custom roles in your organization and then create new ones.

Please note that there is no option to increase this limit, even via a support request.
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-05T20:08:21.0333333+00:00

Hello @Asaf Arnon

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-06T22:07:58.08+00:00

Hello @Asaf Arnon

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Asaf Arnon 0 Reputation points Microsoft Employee

2026-08-06T22:45:10.3133333+00:00

It's Microsoft.com tenant. how do I contact Microsoft tenant support? I thought you are this support.
Nathan Roberts (SN) 13,536 Reputation points Student Ambassador Volunteer Moderator

2026-08-07T10:02:02.4866667+00:00

Hey there, Asaf Arnon

I don't know how you can open a support request to the support team who oversee the Microsoft tenant. I do know some people who do know how to do this and will ask them to reach out to you via PM to provide you with instructions.

I think there is a portal, but I don't want to list it publicly, or suggest it as it may be wrong.

Have you tried removing the roles yourself?

Thanks,
Nathan
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-23T17:37:13.5166667+00:00
Hello @Asaf Arnon

To create an Azure Support Request, please follow the steps outlined in the Microsoft Learn documentation: Manage an Azure support request. [learn.microsoft.com]

Alternatively, you can create a new support request directly from the Azure portal by following these steps:

Sign in to the Azure Portal (https://portal.azure.com).

Select Help + Support from the portal menu or click the? icon in the top-right corner.

Choose Create a support request.

Provide the required details, Review the information and submit the request.

Once the support ticket has been created, please share the Support Request ID with us so that we can update our records and assist you further.

Please let us know if you encounter any difficulties while creating the ticket.
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-24T21:27:58.4033333+00:00

Hello @Asaf Arnon

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-26T20:27:49.72+00:00

Hello @Asaf Arnon

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Ravi Kiran Pagidi 170 Reputation points

2026-08-27T02:27:19.5666667+00:00
Hi Asaf,

RoleDefinitionLimitExceeded means the Microsoft Entra tenant has reached the Azure RBAC custom role definition limit. Custom roles are counted at the tenant level, not only for a single subscription, so this can happen even if you are creating the role in one subscription.

Microsoft Q&A users cannot check or delete roles in the microsoft.com tenant. This needs to be handled by someone with the right RBAC permissions in that tenant/subscription.

You can use Azure Resource Graph to find custom roles that have no assignments:

You can use Azure Resource Graph to find custom roles that have no assignments:

AuthorizationResources | where type =~ "microsoft.authorization/roledefinitions" | where tolower(tostring(properties.type)) == "customrole" | extend roleDefinitionId = tolower(id) | join kind=leftouter ( AuthorizationResources | where type =~ "microsoft.authorization/roleassignments" | extend roleDefinitionId = tolower(tostring(properties.roleDefinitionId)) | summarize assignmentCount = count() by roleDefinitionId ) on roleDefinitionId | where isempty(assignmentCount) | project roleName = tostring(properties.roleName), roleDefinitionId, assignableScopes = properties.assignableScopes

Before deleting any role, confirm it is not needed by another subscription or management group in the same tenant. A custom role can have multiple assignableScopes.

To delete a confirmed unused custom role:

az role definition delete --name "<role-name-or-id>"

1 answer

Your answer

Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-03T17:12:31.8566667+00:00

Hello @Asaf Arnon
As per the public documentation, it appears that you’ve exceeded the custom role definition limit in your tenant.

Could you please confirm how many custom role definitions currently exist in your tenant? To retrieve this information, you can run the query mentioned in the following Microsoft documentation: Troubleshoot Azure RBAC limits

Due to the limitation on the number of custom roles in Azure RBAC (Azure custom roles - Azure RBAC), the recommended approach is to delete any unused custom roles in your organization and then create new ones.

Please note that there is no option to increase this limit, even via a support request.
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-05T20:08:21.0333333+00:00

Hello @Asaf Arnon

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-06T22:07:58.08+00:00

Hello @Asaf Arnon

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Asaf Arnon 0 Reputation points Microsoft Employee

2026-08-06T22:45:10.3133333+00:00

It's Microsoft.com tenant. how do I contact Microsoft tenant support? I thought you are this support.
Nathan Roberts (SN) 13,536 Reputation points Student Ambassador Volunteer Moderator

2026-08-07T10:02:02.4866667+00:00

Hey there, Asaf Arnon

I don't know how you can open a support request to the support team who oversee the Microsoft tenant. I do know some people who do know how to do this and will ask them to reach out to you via PM to provide you with instructions.

I think there is a portal, but I don't want to list it publicly, or suggest it as it may be wrong.

Have you tried removing the roles yourself?

Thanks,
Nathan
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-23T17:37:13.5166667+00:00

Hello @Asaf Arnon

To create an Azure Support Request, please follow the steps outlined in the Microsoft Learn documentation: Manage an Azure support request. [learn.microsoft.com]

Alternatively, you can create a new support request directly from the Azure portal by following these steps:

Sign in to the Azure Portal (https://portal.azure.com).

Select Help + Support from the portal menu or click the? icon in the top-right corner.

Choose Create a support request.

Provide the required details, Review the information and submit the request.

Once the support ticket has been created, please share the Support Request ID with us so that we can update our records and assist you further.

Please let us know if you encounter any difficulties while creating the ticket.
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-24T21:27:58.4033333+00:00

Hello @Asaf Arnon

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Harshitha Eligeti 4,530 Reputation points Microsoft External Staff Moderator

2026-08-26T20:27:49.72+00:00

Hello @Asaf Arnon

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Ravi Kiran Pagidi 170 Reputation points

2026-08-27T02:27:19.5666667+00:00

Hi Asaf,

RoleDefinitionLimitExceeded means the Microsoft Entra tenant has reached the Azure RBAC custom role definition limit. Custom roles are counted at the tenant level, not only for a single subscription, so this can happen even if you are creating the role in one subscription.

Microsoft Q&A users cannot check or delete roles in the microsoft.com tenant. This needs to be handled by someone with the right RBAC permissions in that tenant/subscription.

You can use Azure Resource Graph to find custom roles that have no assignments:

You can use Azure Resource Graph to find custom roles that have no assignments:

AuthorizationResources | where type =~ "microsoft.authorization/roledefinitions" | where tolower(tostring(properties.type)) == "customrole" | extend roleDefinitionId = tolower(id) | join kind=leftouter ( AuthorizationResources | where type =~ "microsoft.authorization/roleassignments" | extend roleDefinitionId = tolower(tostring(properties.roleDefinitionId)) | summarize assignmentCount = count() by roleDefinitionId ) on roleDefinitionId | where isempty(assignmentCount) | project roleName = tostring(properties.roleName), roleDefinitionId, assignableScopes = properties.assignableScopes

Before deleting any role, confirm it is not needed by another subscription or management group in the same tenant. A custom role can have multiple assignableScopes.

To delete a confirmed unused custom role:

az role definition delete --name "<role-name-or-id>"

Answer 1

Hey there, Asaf Arnon

Azure supports 4,000 role assignments per subscriptions which is fixed and cannot be increased. So if you are seeing this error, the only way would be to remove other custom roles so you can create more. More on this can be found here: https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshoot-limits?tabs=default

The only other thing I can think of is trying to create a separate subscription to see if this allows you to create a new role.

Can someone please check orphaned custom roles and delete them ?

You will need to create a support ticket with your IT team and ask them to check.

I do think this is the same internal support ticket you use for reporting issues to IT, however I am unsure.

Hope this helps,
Nathan