How to remove workspace using Service Principal via Azure Pipeline

Hi piotr_szczerba,

Thank you for your patience, and I apologize for the delayed response!

Based on your findings, the issue appears to be primarily related to the execution order of Terraform rather than API permissions. Since an Admin role cannot be removed if it is the only one remaining, your automation should first delete the workspace while the SPN still has Admin access. Once the workspace is deleted, role assignments are automatically removed, thereby avoiding the API restriction.

Regarding API permissions, you are correct that the "Workspace.ReadWrite.All" permission required for role removal is Delegated, meaning it requires a signed-in user rather than an SPN using Application permissions. Unfortunately, Azure Entra does not provide this permission in Application mode, so your SPN cannot directly remove role assignments via the API. However, this should not impact the deletion of the workspace itself if the execution order is correctly followed.

• The error is likely caused by Terraform trying to remove the Admin role before deleting the workspace, rather than an issue with API permissions.
• Adjust the Terraform execution order to ensure the workspace is deleted first while the SPN retains Admin access.
• Since SPNs cannot utilize Delegated permissions, role removal through the API is not feasible for your setup. However, deleting the workspace should automatically address the role assignments.

If you find this post helpful, kindly accept it as a solution to assist other community members who might be facing a similar issue.