Azure Management and governance built-in role
Management Group Reader
Reads management groups, their subscription membership, and Azure authorization metadata without changing hierarchy, policy, or role assignments. It has no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: ac63b705-f282-497d-ac71-919bf39d939d
Control-plane actions (3)
Microsoft.Management/managementGroups/readMicrosoft.Management/managementGroups/subscriptions/readMicrosoft.Authorization/*/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the management group whose hierarchy the principal must inspect. Parent assignments inherit to child management groups and subscriptions, exposing the organization structure and authorization metadata below that point.
Common use cases (2)
- Inspect management-group hierarchy and subscription placement for audit, governance, or platform planning.
- Review authorization metadata alongside hierarchy without moving subscriptions or changing management groups.
Prerequisites (2)
- Identify the hierarchy branch the principal is authorized to inspect.
- Use a separate resource Reader role when configuration of resources inside child subscriptions is also required.
Best practices (2)
- Assign at a branch rather than the tenant root when organization-wide visibility is unnecessary.
- Treat subscription names, hierarchy, and authorization metadata as sensitive governance information.
Security considerations (2)
- The role can reveal tenant organization, subscription placement, and role-assignment metadata.
- It cannot move subscriptions, change management groups, or access workload data.
Assignment guidance
Assign to governance auditors and platform stakeholders at the hierarchy branch they need to inspect. Use Management Group Contributor only for approved hierarchy changes.
Related roles (1)
- Management Group Contributor: Adds management-group lifecycle and subscription move operations.
Common questions
When should I assign the Management Group Reader Azure role?
Assign Management Group Reader when you need to: Inspect management-group hierarchy and subscription placement for audit, governance, or platform planning.; and Review authorization metadata alongside hierarchy without moving subscriptions or changing management groups.. Practical scope: Assign at the management group whose hierarchy the principal must inspect. Parent assignments inherit to child management groups and subscriptions, exposing the organization structure and authorization metadata below that point.
What permissions does the Management Group Reader Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.Management/managementGroups/read; Microsoft.Management/managementGroups/subscriptions/read; and Microsoft.Authorization/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Management Group Reader Azure role?
Key considerations when assigning Management Group Reader: The role can reveal tenant organization, subscription placement, and role-assignment metadata.; and It cannot move subscriptions, change management groups, or access workload data.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- What are Azure management groups? →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.