Unable to Delete Azure Policy Assignment – API Version Error (Azure for Students)

Use an explicit REST DELETE with API version 2024-04-01, but first inspect the assignment because Allowed resource deployment regions can be a subscription-level restriction and a System or SystemHidden assignment may require Microsoft support rather than user deletion.

1. Identify and record the exact assignment

Deleting a policy assignment removes its governance restriction at the assigned scope and can change which deployment regions are permitted. Record its ID, scope, parameters, and assignment type before proceeding.

In Azure Cloud Shell, select Bash, then run:

SUBSCRIPTION_ID=$(az account show --query id -o tsv)
az account set --subscription "$SUBSCRIPTION_ID"

az policy assignment list \
  --query "[?displayName=='Allowed resource deployment regions']" \
  --output json > allowed-regions-assignment.json

cat allowed-regions-assignment.json

The output must contain exactly one intended assignment before it is deleted. Review:

• id: authoritative assignment resource ID
• name: internal name, which can differ from the display name
• scope: actual assigned scope
• assignmentType: Custom, System, or SystemHidden
• parameters: currently allowed locations

Azure for Students commonly uses this assignment to restrict deployments to the regions listed in its Allowed locations parameter.^1^

API version 2024-04-01 supports the immutable assignmentType property and its Custom, System, SystemHidden, and NotSpecified values.^2^

2. Delete it through REST with the required API version

Copy the exact id from the saved JSON, without adding or removing its scope:

ASSIGNMENT_ID="<paste-exact-assignment-id-here>"

az rest \
  --method delete \
  --uri "https://management.azure.com${ASSIGNMENT_ID}?api-version=2024-04-01"

A policy-assignment deletion is addressed by the assignment’s exact scope and name. A successful operation returns 200 OK; 204 No Content means the assignment no longer exists.^3^

Verify deletion using the same ID and API version:

az rest \
  --method get \
  --uri "https://management.azure.com${ASSIGNMENT_ID}?api-version=2024-04-01"

The expected result is a not-found response. Using az rest directly avoids the portal request that is currently selecting the incompatible 2023-04-01 API contract.

Other supported interfaces

If the assignment is user-manageable, Azure CLI supports deletion by its internal name and exact scope:^4^

az policy assignment delete \
  --name "<internal-assignment-name>" \
  --scope "<exact-scope-from-the-assignment>"

PowerShell can delete by the exact resource ID. Avoid broad display-name pipelines and -Force, which could suppress confirmation for an unintended assignment:

$assignmentId = "<exact-assignment-id>"
$assignment = Get-AzPolicyAssignment -Id $assignmentId
$assignment | Format-List *
Remove-AzPolicyAssignment -Id $assignment.Id

Remove-AzPolicyAssignment officially supports deletion by assignment ID.^5^

If deletion is denied

The API-version error establishes a portal/API contract mismatch, but it does not establish that the assignment is yours to remove.

• If assignmentType is Custom, deletion still requires policy-assignment delete permission at the assignment’s actual scope.
• If it is System or SystemHidden, treat it as potentially Microsoft-managed. The assignment type is immutable, and changing API versions does not convert it to a user-managed assignment.^3^
• The Resource Policy Contributor role includes Microsoft.Authorization/policyassignments/*. Ordinary Contributor explicitly excludes Microsoft.Authorization/*/Delete, so Contributor alone is insufficient.^6^^7^

If the REST request returns authorization denial or indicates that a system-managed assignment cannot be removed, open Azure portal → Help + Support → Create a support request. Include the assignment ID, assignment type, timestamp, correlation/request ID, and the complete REST error. Azure provides subscription-management support without requiring a technical support plan, while technical cases can depend on the available plan.^8^

Deleting the resource group or storage account does not affect this assignment when its ID shows that it is assigned at subscription scope.

References

1. How to fix this error while creating a SQL Database? - Microsoft Q&A
2. Microsoft.Authorization policyAssignments 2024-04-01 (deployment-language-arm-template)
3. Policy Assignments - Delete - REST API (Azure Policy)
4. az policy assignment delete
5. Remove-AzPolicyAssignment-Description
6. Azure built-in roles for Management and governance
7. Azure built-in roles for Privileged
8. Create an Azure support request