Creating a custom role which cannot delete a resource group or individual resources within the resource group - azure

Question

I want to create a custom role for developers.
With this custom role the developers should have contributor access to the resource group "TestRessourceGroup" and all its stored resources but the developers should not have the permission to delete this resource group or individual resources within the resource group.
This is what I have so far:
{
"properties": {
"roleName": "Contributor without permission to delete resources",
"description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, share image galleries, or delete resources.",
"assignableScopes": [
"/"
],
"permissions": [
{
"actions": [
"*"
],
"notActions": [
"Microsoft.Authorization/*/Delete",
"Microsoft.Authorization/*/Write",
"Microsoft.Authorization/elevateAccess/Action",
"Microsoft.Blueprint/blueprintAssignments/write",
"Microsoft.Blueprint/blueprintAssignments/delete",
"Microsoft.Compute/galleries/share/action",
"Microsoft.Resources/subscriptions/resourceGroups/delete"
],
"dataActions": [],
"notDataActions": []
}
]
}
}
The developers should still be able to:
delete blobs and containers within a Storage Account
delete compute instances or compute clusters within AMLS
What do I need to add so that users with this custom role cannot delete a resource group or individual resources (like Storage Accounts, Databricks, Key Vaults, AMLS .....) within the resource group but anything else is working like with the normal contributor access?

Answer 1

In you don't want to include resource deletion, the easiest way is to add */delete in the the notActions array:
{
"properties": {
"roleName": "Contributor without permission to delete resources",
"description": "Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, share image galleries, or delete resources.",
"assignableScopes": [
"/"
],
"permissions": [
{
"actions": [
"*"
],
"notActions": [
"*/delete",
"Microsoft.Authorization/*/Write",
"Microsoft.Authorization/elevateAccess/Action",
"Microsoft.Blueprint/blueprintAssignments/write",
"Microsoft.Compute/galleries/share/action"
],
"dataActions": [],
"notDataActions": []
}
]
}
}
You could then having another role to allow users to delete resources inside Machine learning workspace:
{
"properties": {
"roleName": "Allow ML workspace resources deletion",
"description": "",
"assignableScopes": [
"/"
],
"permissions": [
{
"actions": [
"Microsoft.MachineLearningServices/workspaces/*/delete"
],
"notActions": [],
"dataActions": [],
"notDataActions": []
}
]
}
}
If you create an AAD group and assign these two roles to the group, it should work.