← cd ~/roles
// roles/azure · management-and-governance
Service Group ContributorAzure built-in role
Role Definition for contributor of a Service Group
| Role ID | 32e6a4ec-6095-4e37-b54b-12aa350ba81f |
|---|---|
| Category | Management-and-governance |
| Actions | 1 (minus 2 NotActions) |
| Data actions | 0 |
Before you assign it
- Full control. It includes
*, so it can do almost anything to resources in scope, except the 2 operations listed under "Can't do".
What it can do
| Permission | What it allows |
|---|---|
* | Every operation on every resource type |
Can't do
These are taken away from the actions above.
| Permission | What it allows |
|---|---|
Microsoft.Authorization/roleAssignments/write | Create a role assignment at the specified scope. |
Microsoft.Authorization/roleAssignments/delete | Delete a role assignment at the specified scope. |
Assign it
Scope it as tightly as you can: a resource or resource group rather than the whole subscription.
az role assignment create \
--assignee "jane.doe@contoso.com" \
--role "Service Group Contributor" \
--scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
-RoleDefinitionName "Service Group Contributor" `
-Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(resourceGroup().id, principalId, '32e6a4ec-6095-4e37-b54b-12aa350ba81f')
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '32e6a4ec-6095-4e37-b54b-12aa350ba81f')
principalId: principalId
}
}Who already has it?
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "32e6a4ec-6095-4e37-b54b-12aa350ba81f"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)Other management-and-governance roles
- Template Spec Reader · 1 permission
- Carbon Optimization Reader · 2 permissions
- Hierarchy Settings Administrator · 2 permissions
- Reservations Reader · 2 permissions
- Service Group Reader · 2 permissions
- Advisor Reviews Reader · 3 permissions
- Managed Application Operator Role · 3 permissions
- Managed Application Publisher Operator · 3 permissions