I want to give 'Owner' access on subscription level for users, but exclude few resource groups

Question

I want to give 'Owner' access on subscription level for users, but exclude few resource groups.

I want to give 'Owner' access on subscription level for users, but exclude few resource groups. Is there any way ?

Answer 1

You can grant the Owner role to the users, scoped to the subscription, and then add a "deny assignment" to the resource groups for those users. It may be easier to grant owner permissions to users for specific resource groups, though you'd have to remember to grant those permissions anytime a new resource group gets created.

https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments-portal

https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments