Azure Management and governance built-in role

Azure Center for SAP solutions administrator

Provides user administration across Azure Center for SAP solutions, including infrastructure deployment, SAP installation, registration as a Virtual Instance for SAP solutions, health and status, start and stop, and VIS deletion. It spans broad control-plane permissions and includes a VIS start DataAction.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7

Control-plane actions (57)

Data-plane actions (1)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Microsoft documents the role for the subscription or resource groups containing the SAP system. Its compute, network, storage, deployment, and workload permissions make broad inherited scope highly privileged.

Common use cases (2)

Prerequisites (2)

Best practices (2)

Security considerations (2)

Assignment guidance

Assign to trusted SAP platform administrators on the SAP subscription or dedicated resource groups. Use the Reader role for observation, and assign the service role only to the documented user-assigned managed identity.

Related roles (3)

Common questions

When should I assign the Azure Center for SAP solutions administrator Azure role?

Assign Azure Center for SAP solutions administrator when you need to: Deploy infrastructure and install a new SAP system through Azure Center for SAP solutions.; and Register, monitor, start, stop, and manage an existing SAP system represented by a VIS resource.. Practical scope: Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Microsoft documents the role for the subscription or resource groups containing the SAP system. Its compute, network, storage, deployment, and workload permissions make broad inherited scope highly privileged.

What permissions does the Azure Center for SAP solutions administrator Azure role grant?

The role definition grants 58 combined control-plane and data-plane actions. Representative operations include: Microsoft.Advisor/configurations/read; Microsoft.Advisor/recommendations/read; Microsoft.Workloads/sapvirtualInstances/*/read; Microsoft.Workloads/sapVirtualInstances/*/write; Microsoft.Workloads/sapVirtualInstances/*/delete; and Microsoft.Workloads/Locations/*/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Azure Center for SAP solutions administrator Azure role?

Key considerations when assigning Azure Center for SAP solutions administrator: The role can deploy and change SAP infrastructure, install software, operate VMs through VIS, and delete the VIS resource.; and Its broad control-plane surface and VIS start DataAction affect workload integrity, availability, and cost; it is not a least-privilege default for read-only operations.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (6)

Official Microsoft Learn documentation →