Remove deny assignment on my resource

Hello Mihir Nanavati,

Thank you for posting your query on Microsoft Q&A portal.

After checking this in detail, the deny assignment you’re seeing was not created by any user. It is automatically applied by Azure when a Synapse workspace is deployed.

This happens because Synapse creates a managed resource group for its internal components, and Azure applies a system‑defined, system‑protected deny assignment to keep those resources safe. Because of this there is no creator name for the deny assignment, It does not appear in activity logs and It cannot be removed or modified, even by a Subscription Owner.

As long as the Synapse workspace exists, this deny assignment is expected behavior and will remain in place. If you need to make changes, the supported way is to do them through the Synapse workspace itself. Azure will handle the required backend updates automatically.

The deny assignment is removed only if the Synapse workspace itself is deleted, as part of Azure’s cleanup process and should be considered only if the workspace is no longer required.

To delete, Go to all resources, here you can see that workspace name and delete it. Below is the screenshot.