// roles/azure · management-and-governance

Azure Center for SAP solutions readerAzure built-in role

This role provides read access to all capabilities of Azure Center for SAP solutions.

Role ID	`05352d14-a920-4328-a0de-4cbe7430e26b`
Category	Management-and-governance
Actions	43
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Advisor/configurations/read`	Get configurations
`Microsoft.Advisor/recommendations/read`	Reads recommendations
`Microsoft.Workloads/sapvirtualInstances/*/read`	Any read operation on anything under Microsoft.Workloads/sapvirtualInstances
`Microsoft.Workloads/Locations/*/read`	Any read operation on anything under Microsoft.Workloads/Locations
`Microsoft.Workloads/Operations/read`	read Operations
`Microsoft.Workloads/Locations/OperationStatuses/read`	read OperationStatuses
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Insights/alertRules/read`	Read a classic metric alert
`Microsoft.Insights/metrics/read`	Read metrics
`Microsoft.Insights/metricDefinitions/read`	Read metric definitions
`Microsoft.Resources/deployments/read`	Gets or lists deployments.
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/read`	Gets or lists deployments.
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read`	Gets available metrics for the PingMesh
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/virtualNetworks/subnets/virtualMachines/read`	Gets references to all the virtual machines in a virtual network subnet
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/networkInterfaces/ipconfigurations/read`	Gets a network interface ip configuration definition.
`Microsoft.Network/networkInterfaces/loadBalancers/read`	Gets all the load balancers that the network interface is part of
`Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read`	Gets available metrics for the Network Interface
`Microsoft.Network/loadBalancers/read`	Gets a load balancer definition
`Microsoft.Network/loadBalancers/backendAddressPools/read`	Gets a load balancer backend address pool definition
`Microsoft.Network/loadBalancers/frontendIPConfigurations/read`	Gets a load balancer frontend IP configuration definition
`Microsoft.Network/loadBalancers/loadBalancingRules/read`	Gets a load balancer load balancing rule definition
`Microsoft.Network/loadBalancers/inboundNatRules/read`	Gets a load balancer inbound nat rule definition
`Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read`	Gets the events for Load Balancer
`Microsoft.Network/loadBalancers/networkInterfaces/read`	Gets references to all the network interfaces under a load balancer
`Microsoft.Network/loadBalancers/outboundRules/read`	Gets a load balancer outbound rule definition
`Microsoft.Network/loadBalancers/virtualMachines/read`	Gets references to all the virtual machines under a load balancer
`Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read`	Gets the available metrics for Load Balancer
`Microsoft.Network/privateEndpoints/read`	Gets an private endpoint resource.
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.Storage/storageAccounts/blobServices/read`	List blob services
`Microsoft.Storage/storageAccounts/blobServices/containers/read`	Returns a container
`Microsoft.Storage/storageAccounts/fileServices/read`	List file services
`Microsoft.Storage/storageAccounts/fileServices/shares/read`	Get file share
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/availabilitySets/read`	Get the properties of an availability set
`Microsoft.Compute/virtualMachines/extensions/read`	Get the properties of a virtual machine extension
`Microsoft.Compute/disks/read`	Get the properties of a Disk

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Center for SAP solutions reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Center for SAP solutions reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '05352d14-a920-4328-a0de-4cbe7430e26b')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '05352d14-a920-4328-a0de-4cbe7430e26b')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "05352d14-a920-4328-a0de-4cbe7430e26b"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Service Group Contributor · 1 permission
Template Spec Reader · 1 permission
Carbon Optimization Reader · 2 permissions
Hierarchy Settings Administrator · 2 permissions
Reservations Reader · 2 permissions
Service Group Reader · 2 permissions
Advisor Reviews Reader · 3 permissions
Managed Application Operator Role · 3 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles