How to give full Azure admin access to my CTO

Please check whether the access is provided at the root level and there are no role inheritance blocks, Have a look at the detailed steps below.

1. Assign the Correct Role at the Root Level

Azure follows a Role-Based Access Control (RBAC) model, where permissions are inherited down the hierarchy. Ensure your CTO is granted Owner access at the root management group or subscription level.

Steps:

1. Go to the Azure Portal > Management Groups or Subscriptions.
2. Select the root management group (or the appropriate subscription).
3. Navigate to Access Control (IAM) > Add Role Assignment.
4. Assign the Owner role to your CTO’s user account.

This ensures they have complete permissions, which flow down to all resources unless explicitly denied.

2. Check for Role Inheritance Blocks

Sometimes, permissions are blocked at lower resource levels, which can override inherited roles.

Steps to Verify:

1. Go to the problematic resource (e.g., a VM, Storage Account).
2. Under Access Control (IAM), check for any Deny Assignments or custom role overrides.
3. Remove or adjust any restrictions that might block inherited permissions.

Please mark this as an Answer if this helps solve your problem.