← cd ~/roles
// roles/azure · management-and-governance
Service Group AdministratorAzure built-in role
Role Definition for administrator of a Service Group
| Role ID | 4e50c84c-c78e-4e37-b47e-e60ffea0a775 |
|---|---|
| Category | Management-and-governance |
| Actions | 3 (minus 2 NotActions) |
| Data actions | 0 |
Before you assign it
- Full control. It includes
*, so it can do almost anything to resources in scope, except the 2 operations listed under "Can't do".
What it can do
| Permission | What it allows |
|---|---|
* | Every operation on every resource type |
Microsoft.Authorization/roleAssignments/write | Create a role assignment at the specified scope. |
Microsoft.Authorization/roleAssignments/delete | Delete a role assignment at the specified scope. |
Can't do
These are taken away from the actions above.
| Permission | What it allows |
|---|---|
Microsoft.Authorization/roleAssignments/write | Create a role assignment at the specified scope. |
Microsoft.Authorization/roleAssignments/delete | Delete a role assignment at the specified scope. |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "Service Group Administrator" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "Service Group Administrator" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, '4e50c84c-c78e-4e37-b47e-e60ffea0a775')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4e50c84c-c78e-4e37-b47e-e60ffea0a775')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "4e50c84c-c78e-4e37-b47e-e60ffea0a775"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other management-and-governance roles
- Service Group Contributor · 1 permission
- Template Spec Reader · 1 permission
- Carbon Optimization Reader · 2 permissions
- Hierarchy Settings Administrator · 2 permissions
- Reservations Reader · 2 permissions
- Service Group Reader · 2 permissions
- Advisor Reviews Reader · 3 permissions
- Managed Application Operator Role · 3 permissions