// roles/azure · management-and-governance

Azure Center for SAP solutions service roleAzure built-in role

Azure Center for SAP solutions service role - This role is intended to be used for providing the permissions to user assigned managed identity. Azure Center for SAP solutions will use this identity to deploy and manage SAP systems.

Role ID	`aabbc5dd-1af0-458b-a942-81af88f9c138`
Category	Management-and-governance
Actions	55
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Resources/subscriptions/resourceGroups/write`	Creates or updates a resource group.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/*`	Every operation under Microsoft.Resources/subscriptions/resourcegroups/deployments
`Microsoft.Network/loadBalancers/read`	Gets a load balancer definition
`Microsoft.Network/loadBalancers/write`	Creates a load balancer or updates an existing load balancer
`Microsoft.Network/loadBalancers/backendAddressPools/read`	Gets a load balancer backend address pool definition
`Microsoft.Network/loadBalancers/backendAddressPools/write`	Creates a load balancer backend address pool or updates an existing load balancer backend address pool
`Microsoft.Network/loadBalancers/frontendIPConfigurations/read`	Gets a load balancer frontend IP configuration definition
`Microsoft.Network/loadBalancers/loadBalancingRules/read`	Gets a load balancer load balancing rule definition
`Microsoft.Network/loadBalancers/inboundNatRules/read`	Gets a load balancer inbound nat rule definition
`Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read`	Gets the events for Load Balancer
`Microsoft.Network/loadBalancers/networkInterfaces/read`	Gets references to all the network interfaces under a load balancer
`Microsoft.Network/loadBalancers/outboundRules/read`	Gets a load balancer outbound rule definition
`Microsoft.Network/loadBalancers/virtualMachines/read`	Gets references to all the virtual machines under a load balancer
`Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read`	Gets the available metrics for Load Balancer
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/networkInterfaces/write`	Creates a network interface or updates an existing network interface.
`Microsoft.Network/networkInterfaces/ipconfigurations/read`	Gets a network interface ip configuration definition.
`Microsoft.Network/networkInterfaces/loadBalancers/read`	Gets all the load balancers that the network interface is part of
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/virtualNetworks/checkIpAddressAvailability/read`	Check if IP Address is available at the specified virtual network
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/virtualNetworks/subnets/virtualMachines/read`	Gets references to all the virtual machines in a virtual network subnet
`Microsoft.Network/virtualNetworks/virtualMachines/read`	Gets references to all the virtual machines in a virtual network
`Microsoft.Network/networkInterfaces/ipconfigurations/join/action`	Joins a Network Interface IP Configuration. Not alertable.
`Microsoft.Network/privateEndpoints/read`	Gets an private endpoint resource.
`Microsoft.Network/privateEndpoints/write`	Creates a new private endpoint, or updates an existing private endpoint.
`Microsoft.Network/networkInterfaces/join/action`	Joins a Virtual Machine to a network interface. Not Alertable.
`Microsoft.Network/loadBalancers/backendAddressPools/join/action`	Joins a load balancer backend address pool. Not Alertable.
`Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action`	Joins a Load Balancer Frontend IP Configuration. Not alertable.
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/action`	Joins a load balancer to virtual network subnets
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.Storage/storageAccounts/write`	Creates a storage account with the specified parameters or update the properties or tags or adds custom domain for the specified storage account.
`Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action`	Approve Private Endpoint Connections
`Microsoft.Storage/storageAccounts/blobServices/read`	List blob services
`Microsoft.Storage/storageAccounts/blobServices/containers/read`	Returns a container
`Microsoft.Storage/storageAccounts/fileServices/read`	List file services
`Microsoft.Storage/storageAccounts/fileServices/write`	Put file service properties
`Microsoft.Storage/storageAccounts/fileServices/shares/read`	Get file share
`Microsoft.Storage/storageAccounts/fileServices/shares/write`	Create or update file share
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/virtualMachines/write`	Creates a new virtual machine or updates an existing virtual machine
`Microsoft.Compute/virtualMachines/instanceView/read`	Gets the detailed runtime status of the virtual machine and its resources
`Microsoft.Compute/availabilitySets/read`	Get the properties of an availability set
`Microsoft.Compute/availabilitySets/write`	Creates a new availability set or updates an existing one
`Microsoft.Compute/skus/read`	Gets the list of Microsoft.Compute SKUs available for your Subscription
`Microsoft.Compute/sshPublicKeys/read`	Get the properties of an SSH public key
`Microsoft.Compute/virtualMachines/extensions/read`	Get the properties of a virtual machine extension
`Microsoft.Compute/virtualMachines/extensions/write`	Creates a new virtual machine extension or updates an existing one
`Microsoft.Compute/virtualMachines/extensions/delete`	Deletes the virtual machine extension
`Microsoft.Compute/disks/read`	Get the properties of a Disk
`Microsoft.Compute/disks/write`	Creates a new Disk or updates an existing one

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Center for SAP solutions service role" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Center for SAP solutions service role" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'aabbc5dd-1af0-458b-a942-81af88f9c138')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aabbc5dd-1af0-458b-a942-81af88f9c138')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "aabbc5dd-1af0-458b-a942-81af88f9c138"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Service Group Contributor · 1 permission
Template Spec Reader · 1 permission
Carbon Optimization Reader · 2 permissions
Hierarchy Settings Administrator · 2 permissions
Reservations Reader · 2 permissions
Service Group Reader · 2 permissions
Advisor Reviews Reader · 3 permissions
Managed Application Operator Role · 3 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles