// roles/azure · management-and-governance

Azure Center for SAP solutions administratorAzure built-in role

This role provides read and write access to all capabilities of Azure Center for SAP solutions.

Role ID	`7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7`
Category	Management-and-governance
Actions	57
Data actions	1

Before you assign it

It reaches the data, not just the resource. It has 1 data action, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.Advisor/configurations/read`	Get configurations
`Microsoft.Advisor/recommendations/read`	Reads recommendations
`Microsoft.Workloads/sapvirtualInstances/*/read`	Any read operation on anything under Microsoft.Workloads/sapvirtualInstances
`Microsoft.Workloads/sapVirtualInstances/*/write`	Any write operation on anything under Microsoft.Workloads/sapVirtualInstances
`Microsoft.Workloads/sapVirtualInstances/*/delete`	Any delete operation on anything under Microsoft.Workloads/sapVirtualInstances
`Microsoft.Workloads/Locations/*/action`	Any action on anything under Microsoft.Workloads/Locations
`Microsoft.Workloads/Locations/*/read`	Any read operation on anything under Microsoft.Workloads/Locations
`Microsoft.Workloads/sapVirtualInstances/*/start/action`	Every operation matching Microsoft.Workloads/sapVirtualInstances/*/start/action
`Microsoft.Workloads/sapVirtualInstances/*/stop/action`	Every operation matching Microsoft.Workloads/sapVirtualInstances/*/stop/action
`Microsoft.Workloads/connectors/*/read`	Any read operation on anything under Microsoft.Workloads/connectors
`Microsoft.Workloads/connectors/*/write`	Any write operation on anything under Microsoft.Workloads/connectors
`Microsoft.Workloads/connectors/*/delete`	Any delete operation on anything under Microsoft.Workloads/connectors
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Insights/metrics/read`	Read metrics
`Microsoft.Insights/metricDefinitions/read`	Read metric definitions
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourceGroups/write`	Creates or updates a resource group.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/*`	Every operation under Microsoft.Resources/subscriptions/resourcegroups/deployments
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read`	Gets available metrics for the PingMesh
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/virtualNetworks/subnets/write`	Creates a virtual network subnet or updates an existing virtual network subnet
`Microsoft.Network/virtualNetworks/subnets/virtualMachines/read`	Gets references to all the virtual machines in a virtual network subnet
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/networkInterfaces/ipconfigurations/read`	Gets a network interface ip configuration definition.
`Microsoft.Network/networkInterfaces/loadBalancers/read`	Gets all the load balancers that the network interface is part of
`Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read`	Gets available metrics for the Network Interface
`Microsoft.Network/loadBalancers/read`	Gets a load balancer definition
`Microsoft.Network/loadBalancers/backendAddressPools/read`	Gets a load balancer backend address pool definition
`Microsoft.Network/loadBalancers/frontendIPConfigurations/read`	Gets a load balancer frontend IP configuration definition
`Microsoft.Network/loadBalancers/loadBalancingRules/read`	Gets a load balancer load balancing rule definition
`Microsoft.Network/loadBalancers/inboundNatRules/read`	Gets a load balancer inbound nat rule definition
`Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read`	Gets the events for Load Balancer
`Microsoft.Network/loadBalancers/networkInterfaces/read`	Gets references to all the network interfaces under a load balancer
`Microsoft.Network/loadBalancers/outboundRules/read`	Gets a load balancer outbound rule definition
`Microsoft.Network/loadBalancers/virtualMachines/read`	Gets references to all the virtual machines under a load balancer
`Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read`	Gets the available metrics for Load Balancer
`Microsoft.Network/privateEndpoints/read`	Gets an private endpoint resource.
`Microsoft.Network/networkSecurityGroups/join/action`	Joins a network security group. Not Alertable.
`Microsoft.Network/routeTables/join/action`	Joins a route table. Not Alertable.
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.Storage/storageAccounts/blobServices/read`	List blob services
`Microsoft.Storage/storageAccounts/blobServices/containers/read`	Returns a container
`Microsoft.Storage/storageAccounts/fileServices/read`	List file services
`Microsoft.Storage/storageAccounts/fileServices/shares/read`	Get file share
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/availabilitySets/read`	Get the properties of an availability set
`Microsoft.Compute/sshPublicKeys/read`	Get the properties of an SSH public key
`Microsoft.Compute/sshPublicKeys/write`	Creates a new SSH public key or updates an existing SSH public key
`Microsoft.Compute/sshPublicKeys/*/generateKeyPair/action`	Every operation matching Microsoft.Compute/sshPublicKeys/*/generateKeyPair/action
`Microsoft.Compute/virtualMachines/extensions/read`	Get the properties of a virtual machine extension
`Microsoft.Compute/virtualMachines/extensions/delete`	Deletes the virtual machine extension
`Microsoft.Compute/disks/read`	Get the properties of a Disk

Data actions

Permission	What it allows
`Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`	Returns a blob or a list of blobs

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Center for SAP solutions administrator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Center for SAP solutions administrator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Service Group Contributor · 1 permission
Template Spec Reader · 1 permission
Carbon Optimization Reader · 2 permissions
Hierarchy Settings Administrator · 2 permissions
Reservations Reader · 2 permissions
Service Group Reader · 2 permissions
Advisor Reviews Reader · 3 permissions
Managed Application Operator Role · 3 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles