Configure account suspension in Azure

task australia Updated Sep 10, 2026 1 min read configuring-azure-suspension-permission.md

Manage an Azure subscription using the permission and by assigning the role to a user. The role must have the permission to execute the APIs for suspending and reactivating an Azure account.

Before you begin

Role required: Azure admin

Procedure

Sign in to the Azure organization.
Search and select Management groups.
Select Tenant Root Group.
Select Access Control > Roles.
Select Add and then select Add custom role.
In the Custom role name box, specify a name for the custom role.

The name must be unique for the Microsoft Entra directory.
Select Next.
On the Permissions tab, select Next.
On the Assignable scopes tab, you specify where your custom role is available for assignment, such as management group, subscriptions, or resource groups.
Select Add assignable scopes to open the Add assignable scopes pane.

On the JSON tab, paste the following code:

Shell

{    "properties": {        "roleName": "Policy Lock/Unlock Manager",        "description": "Allows locking and unlocking Azure Policy assignments at management group level",        "assignableScopes": [            "/providers/Microsoft.Management/managementGroups/<ManagementGroupId>”         ],        "permissions": [            {                "actions": [                    "Microsoft.Authorization/policyAssignments/write",                    "Microsoft.Authorization/policyAssignments/delete",                    "Microsoft.Authorization/policyAssignments/read"                ],                "notActions": [],                "dataActions": [],                "notDataActions": []            }        ]    }}

Select Next and then select Create.

What to do next

You must assign the permission to a role. For more information, see https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal.

Configure a lock/unlock policy. For more information, see Set up suspension of a subscription using Azure policy.

82 lines · 3.2 KB Wrap lines

---
title: Configure account suspension in Azure
description: Manage an Azure subscription using the permission and by assigning the role to a user. The role must have the permission to execute the APIs for suspending and reactivating an Azure account.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/it-operations-management/cloud-account-management/configuring-azure-suspension-permission.html
release: australia
product: Cloud Account Management
classification: cloud-account-management
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Setting up Azure cloud, Configuring cloud providers, Configure, Cloud Account Management, ITOM Cloud Accelerate, IT Operations Management]
---

# Configure account suspension in Azure

Manage an Azure subscription using the permission and by assigning the role to a user. The role must have the permission to execute the APIs for suspending and reactivating an Azure account.

## Before you begin

Role required: Azure admin

## Procedure

1. Sign in to the Azure organization.

2. Search and select **Management groups**.

3. Select **Tenant Root Group**.

4. Select **Access Control** &gt; **Roles**.

5. Select **Add** and then select **Add custom role**.

6. In the **Custom role name** box, specify a name for the custom role.

The name must be unique for the Microsoft Entra directory.

7. Select **Next**.

8. On the **Permissions** tab, select **Next**.

9. On the **Assignable scopes** tab, you specify where your custom role is available for assignment, such as management group, subscriptions, or resource groups.

10. Select Add assignable scopes to open the Add assignable scopes pane.

11. On the **JSON** tab, paste the following code:

```
{
"properties": {
"roleName": "Policy Lock/Unlock Manager",
"description": "Allows locking and unlocking Azure Policy assignments at management group level",
"assignableScopes": [
"/providers/Microsoft.Management/managementGroups/<ManagementGroupId>”
],
"permissions": [
{
"actions": [
"Microsoft.Authorization/policyAssignments/write",
"Microsoft.Authorization/policyAssignments/delete",
"Microsoft.Authorization/policyAssignments/read"
],
"notActions": [],
"dataActions": [],
"notDataActions": []
}
]
}
}
```

12. Select **Next** and then select **Create**.

## What to do next

You must assign the permission to a role. For more information, see [https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal).

Configure a lock/unlock policy. For more information, see [Set up suspension of a subscription using Azure policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/cloud-account-management/configuring-lock-unlock-policy-for-azure.md).