Azure Management and governance built-in role

Azure Center for SAP solutions administrator

Provides user administration across Azure Center for SAP solutions, including infrastructure deployment, SAP installation, registration as a Virtual Instance for SAP solutions, health and status, start and stop, and VIS deletion. It spans broad control-plane permissions and includes a VIS start DataAction.

Control-plane actions (57)

• Microsoft.Advisor/configurations/read
• Microsoft.Advisor/recommendations/read
• Microsoft.Workloads/sapvirtualInstances/*/read
• Microsoft.Workloads/sapVirtualInstances/*/write
• Microsoft.Workloads/sapVirtualInstances/*/delete
• Microsoft.Workloads/Locations/*/action
• Microsoft.Workloads/Locations/*/read
• Microsoft.Workloads/sapVirtualInstances/*/start/action
• Microsoft.Workloads/sapVirtualInstances/*/stop/action
• Microsoft.Workloads/connectors/*/read
• Microsoft.Workloads/connectors/*/write
• Microsoft.Workloads/connectors/*/delete
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Insights/alertRules/*
• Microsoft.Insights/metrics/read
• Microsoft.Insights/metricDefinitions/read
• Microsoft.Resources/deployments/*
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/subscriptions/resourceGroups/write
• Microsoft.Resources/subscriptions/resourcegroups/deployments/*
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Network/virtualNetworks/read
• Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read
• Microsoft.Network/virtualNetworks/subnets/read
• Microsoft.Network/virtualNetworks/subnets/write
• Microsoft.Network/virtualNetworks/subnets/virtualMachines/read
• Microsoft.Network/networkInterfaces/read
• Microsoft.Network/networkInterfaces/ipconfigurations/read
• Microsoft.Network/networkInterfaces/loadBalancers/read
• Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read
• Microsoft.Network/loadBalancers/read
• Microsoft.Network/loadBalancers/backendAddressPools/read
• Microsoft.Network/loadBalancers/frontendIPConfigurations/read
• Microsoft.Network/loadBalancers/loadBalancingRules/read
• Microsoft.Network/loadBalancers/inboundNatRules/read
• Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read
• Microsoft.Network/loadBalancers/networkInterfaces/read
• Microsoft.Network/loadBalancers/outboundRules/read
• Microsoft.Network/loadBalancers/virtualMachines/read
• Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read
• Microsoft.Network/privateEndpoints/read
• Microsoft.Network/networkSecurityGroups/join/action
• Microsoft.Network/routeTables/join/action
• Microsoft.Storage/storageAccounts/read
• Microsoft.Storage/storageAccounts/blobServices/read
• Microsoft.Storage/storageAccounts/blobServices/containers/read
• Microsoft.Storage/storageAccounts/fileServices/read
• Microsoft.Storage/storageAccounts/fileServices/shares/read
• Microsoft.Compute/virtualMachines/read
• Microsoft.Compute/availabilitySets/read
• Microsoft.Compute/sshPublicKeys/read
• Microsoft.Compute/sshPublicKeys/write
• Microsoft.Compute/sshPublicKeys/*/generateKeyPair/action
• Microsoft.Compute/virtualMachines/extensions/read
• Microsoft.Compute/virtualMachines/extensions/delete
• Microsoft.Compute/disks/read

Data-plane actions (1)

• Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Microsoft documents the role for the subscription or resource groups containing the SAP system. Its compute, network, storage, deployment, and workload permissions make broad inherited scope highly privileged.

Common use cases (2)

• Deploy infrastructure and install a new SAP system through Azure Center for SAP solutions.
• Register, monitor, start, stop, and manage an existing SAP system represented by a VIS resource.

Prerequisites (2)

• Register the Microsoft.Workloads resource provider and meet the supported SAP system and connectivity prerequisites.
• For existing user-assigned identities, the user also needs Managed Identity Operator, while the identity needs the service role on compute and storage resources and Reader on virtual-network resources.

Best practices (2)

• Assign to a small SAP platform administration group at the SAP system resource groups rather than broadly across unrelated workloads.
• Keep the human administrator role separate from the user-assigned managed identity service role.

Security considerations (2)

• The role can deploy and change SAP infrastructure, install software, operate VMs through VIS, and delete the VIS resource.
• Its broad control-plane surface and VIS start DataAction affect workload integrity, availability, and cost; it is not a least-privilege default for read-only operations.

Assignment guidance

Assign to trusted SAP platform administrators on the SAP subscription or dedicated resource groups. Use the Reader role for observation, and assign the service role only to the documented user-assigned managed identity.

Related roles (3)

• Azure Center for SAP solutions reader: Read-only user counterpart for VIS resources.
• Azure Center for SAP solutions service role: Separate role for the user-assigned managed identity used by the service.
• Managed Identity Operator: Microsoft documents this companion role when a user assigns an existing user-assigned managed identity to the VIS.

Editorial sources (6)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Azure RBAC for Azure Center for SAP solutions →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Register an existing SAP system →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →