Azure Management and governance built-in role

Azure Center for SAP solutions reader

Reads Azure Center for SAP solutions Virtual Instance for SAP solutions resources and the supporting compute, network, storage, and workload configuration needed to display SAP system health and status. It has no write Actions or DataActions.

Control-plane actions (43)

• Microsoft.Advisor/configurations/read
• Microsoft.Advisor/recommendations/read
• Microsoft.Workloads/sapvirtualInstances/*/read
• Microsoft.Workloads/Locations/*/read
• Microsoft.Workloads/Operations/read
• Microsoft.Workloads/Locations/OperationStatuses/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Insights/alertRules/read
• Microsoft.Insights/metrics/read
• Microsoft.Insights/metricDefinitions/read
• Microsoft.Resources/deployments/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/read
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Network/virtualNetworks/read
• Microsoft.Network/virtualNetworks/providers/Microsoft.Insights/metricDefinitions/read
• Microsoft.Network/virtualNetworks/subnets/read
• Microsoft.Network/virtualNetworks/subnets/virtualMachines/read
• Microsoft.Network/networkInterfaces/read
• Microsoft.Network/networkInterfaces/ipconfigurations/read
• Microsoft.Network/networkInterfaces/loadBalancers/read
• Microsoft.Network/networkInterfaces/providers/Microsoft.Insights/metricDefinitions/read
• Microsoft.Network/loadBalancers/read
• Microsoft.Network/loadBalancers/backendAddressPools/read
• Microsoft.Network/loadBalancers/frontendIPConfigurations/read
• Microsoft.Network/loadBalancers/loadBalancingRules/read
• Microsoft.Network/loadBalancers/inboundNatRules/read
• Microsoft.Network/loadBalancers/providers/Microsoft.Insights/logDefinitions/read
• Microsoft.Network/loadBalancers/networkInterfaces/read
• Microsoft.Network/loadBalancers/outboundRules/read
• Microsoft.Network/loadBalancers/virtualMachines/read
• Microsoft.Network/loadBalancers/providers/Microsoft.Insights/metricDefinitions/read
• Microsoft.Network/privateEndpoints/read
• Microsoft.Storage/storageAccounts/read
• Microsoft.Storage/storageAccounts/blobServices/read
• Microsoft.Storage/storageAccounts/blobServices/containers/read
• Microsoft.Storage/storageAccounts/fileServices/read
• Microsoft.Storage/storageAccounts/fileServices/shares/read
• Microsoft.Compute/virtualMachines/read
• Microsoft.Compute/availabilitySets/read
• Microsoft.Compute/virtualMachines/extensions/read
• Microsoft.Compute/disks/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign on the VIS or the dedicated resource groups whose SAP system the principal must inspect; broader scope exposes supporting infrastructure metadata for every inherited SAP estate.

Common use cases (2)

• View registered SAP systems, component discovery, health, status, and supporting Azure resource configuration.
• Provide SAP operations, audit, or support visibility without start, stop, registration, deployment, or deletion authority.

Prerequisites (2)

• The SAP system must be registered as a VIS resource for Azure Center for SAP solutions visibility.
• The principal must need observation only; start, stop, registration, and deployment require Administrator.

Best practices (2)

• Assign at the VIS or SAP resource-group boundary instead of a broad subscription when possible.
• Treat infrastructure and SAP component metadata as sensitive operational information.

Security considerations (2)

• The role exposes SAP topology, VM, disk, load-balancer, storage, network, and system health metadata.
• It has no DataActions and does not start, stop, deploy, install, register, or delete SAP resources.

Assignment guidance

Assign to SAP support, audit, or operations principals that need VIS visibility only. Escalate to Administrator only for a documented management action, and keep the service identity role separate.

Related roles (1)

• Azure Center for SAP solutions administrator: Adds deployment, installation, registration, lifecycle, and VIS operations.

Editorial sources (6)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Azure RBAC for Azure Center for SAP solutions →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Register an existing SAP system →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →