Merge pull request #281199 from dcurwin/wi-271973-remove-permissions-july18-2024

Removing permissions

Author: prmerger-automator[bot]

articles/defender-for-cloud/tenant-wide-permissions-management.md

@@ -74,6 +74,18 @@ To request elevated permissions from your global administrator:
 
     After the global administrator selects **Review the request** and completes the process, the decision is emailed to the requesting user.
 
+## Removing permissions
+
+To remove permissions from the root tenant group, follow these steps:
+
+1. Go to the Azure portal.
+1. In the Azure portal, search for **Management Groups** in the search bar at the top.
+1. In the **Management Groups** pane, find and select the **Tenant Root Group** from the list of management groups.
+1. Once inside the **Tenant Root Group**, select **Access Control (IAM)** in the left-hand menu.
+1. In the **Access Control (IAM)** pane, select the **Role assignments** tab. This shows a list of all role assignments for the **Tenant Root Group**.
+1. Review the list of role assignments to identify which one you need to remove.
+1. Select the role assignment you want to remove (**Security admin** or **Security reader**) and select **Remove**. Ensure you have the necessary permissions to make changes to role assignments in the **Tenant Root Group**.
+
 ## Next steps
 
 Learn more about Defender for Cloud permissions in the following related page: