We inherited a legacy Azure PAYG subscription that was originally created and managed by an employee who has since retired. Billing has been moved to organizational ownership: the payment method, billing profile name, billing contacts, and invoice recipients are all updated, and invoices are being generated and paid normally. Multiple current IT administrators and a central account have also been assigned as Owners at the billing account, billing profile, and subscription levels.
However, the former employee still appears as a direct Owner on the subscription. When we try to remove that assignment from Subscription IAM, Azure returns: "CannotDeleteLastRbacAdminAssignment". The account is still enabled for now but may soon be disabled or deprovisioned. The subscription hosts an application that may be rolled out more broadly across the organization.
Could there be a hidden relationship involving the original subscription creator, account administrator, billing administrator, or management group ownership? Would disabling the old account affect administration, billing, or application availability? We want to clean this up safely and would prefer not to use the billing ownership transfer workflow unless it is genuinely required. Has anyone resolved this error, and is Microsoft Support typically needed? Also, what governance checks would you complete before putting an inherited subscription into wider production use?
5 Answers
Disabling the former employee should not stop the running application or interrupt successful billing by itself, but it can expose an administration problem if Azure still depends on that account for the last valid RBAC administrator relationship. Before deprovisioning, create at least two independent administrative paths, preferably through managed identities or tightly controlled emergency accounts, verify access at the subscription and resource levels, review management-group inheritance, and document the subscription's owners and recovery process. Given the planned organizational rollout, I would resolve this before expansion rather than leave a known ownership dependency in place.
Billing ownership and Azure RBAC ownership are separate systems. Having active Owners on the billing account or billing profile does not necessarily make the old subscription-level Owner removable. Also inspect the management group hierarchy for inherited ownership or other assignments connected to the former employee. If the portal still reports that the old account is the last RBAC administrator after you establish a direct active replacement, Microsoft Support may need to correct the backend relationship.
Opening a Microsoft support case is reasonable here. Support can determine whether the error is caused by an overlooked direct or inherited assignment, an eligible role, a management-group relationship, or stale subscription metadata that cannot be fixed through the portal. Keep the existing administrative access intact while waiting, but avoid treating the retired account as a long-term control and complete the cleanup before wider production use.
A support request is already open. I was mainly trying to determine whether this error points to an MCA or account-administrator dependency while waiting for Microsoft's response.
Global Administrators can use Azure's elevated access feature to regain or establish subscription-level access, provided the organization's policies allow it. After access is elevated, assign a dedicated break-glass or platform identity as a direct Owner and then remove the retired employee. Record the elevation and role changes in your audit process, and turn off the elevation afterward if appropriate.
A practical workaround is to assign Owner directly to a dedicated platform identity or another administrator, then remove the former employee. Make sure the replacement assignment is a direct, active subscription-level Owner assignment—not merely an eligible role, an inherited role, or an assignment through a management group. Azure may still treat the old account as the last valid RBAC administrator if the other Owners do not meet those conditions.
Check every current Owner to confirm whether the assignment is active and direct. Eligible assignments and inherited management-group permissions may not satisfy the last-RBAC-admin check.
A Global Administrator can generally reclaim subscription access, but billing roles are not the same as Azure RBAC roles. I would not assume that successful billing migration has completed the subscription access cleanup.