How to find role assignments of deleted identities in Azure

Before you start

Use an account that can read role assignments at the scopes you want to check, such as one with the built-in Reader role, and that can read the directory. A member account of the tenant can by default; a guest account has restricted directory permissions, so every principal looks unknown to it. Microsoft lists no separate licence for reading assignments.

Know why the rows matter. Microsoft says an assignment to a deleted principal still grants access while that principal holds a valid token that hasn't expired, and the assignments count towards each subscription's limit. A user invited moments ago can also show as not found until it replicates, so check new names again before acting. The examples read and export, and change nothing. The script's finally block disconnects the account and clears its saved Azure contexts.

Option 1

Find role assignments of deleted identities with PowerShell

Install the modules once. The script reads the assignments of each enabled subscription, stops if no principal could be named, and saves the assignments whose principal is unknown.

Install-Module -Name Az.Accounts, Az.Resources -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptions = @(Get-AzSubscription | Where-Object State -eq 'Enabled')
    if ($subscriptions.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $all = @{}
    foreach ($sub in $subscriptions) {
        Set-AzContext -Subscription $sub.Id -Tenant $sub.TenantId -Scope Process | Out-Null
        Get-AzRoleAssignment | ForEach-Object { $all[$_.RoleAssignmentId] = $_ }
    }
    $known = @($all.Values | Where-Object ObjectType -ne 'Unknown')
    if ($all.Count -gt 0 -and $known.Count -eq 0) {
        Write-Output 'Every principal is Unknown. Check that this account can read the directory.'
        return
    }
    $rows = @($all.Values | Where-Object ObjectType -eq 'Unknown' |
        Sort-Object Scope, RoleDefinitionName)
    if ($rows.Count -eq 0) {
        Write-Output 'No role assignments to deleted identities were found.'
    } else {
        $rows | Select-Object ObjectId, RoleDefinitionName, Scope, RoleAssignmentId |
            Export-Csv -Path './deleted-identity-assignments.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) assignments saved to deleted-identity-assignments.csv."
    }
} finally {
    Disconnect-AzAccount | Out-Null
}

The CSV holds the object ID the assignment names, the role, the scope and the assignment ID, which is what you need to remove it later. An assignment at a management group or the root is read from every subscription it reaches, so the script keeps each assignment ID once. To check fewer subscriptions, filter $subscriptions. Before removing a row, search the directory for its object ID: if it belongs to an object that still exists, the account couldn't read it rather than it being deleted.

Option 2

Find deleted identities in the Azure portal

1. Sign in to the Azure portal with an account that can read the scope's role assignments and the directory.
2. Choose All services > Subscriptions, or Management groups, then select the scope.
3. Choose Access control (IAM) > Role assignments.
4. Look for principals listed as Identity not found with the type Unknown, and note each one's role and scope.
5. Repeat for each subscription and management group. Leave the page without removing anything.

Download role assignments leaves these assignments out of its file, so the list on screen is the portal's only view of them. This method suits a quick look at 1 scope; for every subscription at once, use PowerShell or Altivane.

Common questions

Is it safe to remove these assignments?

Microsoft recommends removing assignments that aren't used, and an assignment to a principal that no longer exists has no one to serve. First confirm the object ID isn't a user invited in the last few minutes, and that the account running the check can read the directory.

Why does every assignment show as Unknown?

The account can't read the principals' details in Microsoft Entra ID, which is common for a guest account. Run the check again with a member account, or one that holds the Directory Readers role.

Do deleted guests show here as well?

Yes. Once a guest is deleted, its assignments look the same as any other deleted principal's. To review guests who still exist, see how to find guests with access to Azure.