Azure Management and governance built-in role
Service Group Administrator
Preview role that manages all aspects of Azure Service Groups and relationships and is assigned by default to a user who creates a service group. It also creates and deletes role assignments, but an ABAC condition restricts delegation to the Service Group Administrator, Contributor, and Reader role definition IDs.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4e50c84c-c78e-4e37-b47e-e60ffea0a775
Control-plane actions (3)
*Microsoft.Authorization/roleAssignments/writeMicrosoft.Authorization/roleAssignments/delete
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (2)
Microsoft.Authorization/roleAssignments/writeMicrosoft.Authorization/roleAssignments/delete
Conditions (1)
Condition version: 2.0
((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97}))
Assignable scopes (1)
/providers/Microsoft.Management/serviceGroups
Practical scope
The definition is assignable only under `/providers/Microsoft.Management/serviceGroups`, a tenant-level Service Groups provider hierarchy with one root service group. Access at a parent service group applies through connected child relationships; it is not an Azure management-group or subscription scope.
Common use cases (2)
- Create and administer preview service groups and connect supported resources or groups through service relationships.
- Delegate one of the three Service Group roles while preserving the built-in role-definition condition.
Prerequisites (2)
- Use the Service Groups preview and initialize the tenant root service group.
- Root access requires tenant-level role-assignment write authority; Microsoft notes a Global Administrator can elevate Azure access for that task, but the Entra role is not duplicated here.
Best practices (2)
- Preserve the built-in ABAC condition and assign below the root whenever tenant-wide administration is unnecessary.
- Treat Service Groups and custom RBAC limitations as preview constraints and review the feature before production dependency.
Security considerations (2)
- The wildcard Actions grant broad control in the Service Groups provider hierarchy.
- The ABAC condition limits role assignment to three Service Group roles but does not limit which principal receives an allowed role; scope and membership governance remain essential.
Assignment guidance
Assign at the specific service group to its governance administrator. Use root scope only for tenant service-group administrators, retain the condition, and use Contributor when role delegation is unnecessary.
Related roles (2)
- Service Group Contributor: Manages service groups and relationships without role assignment authority.
- Service Group Reader: Read-only view of service groups and relationships.
Common questions
When should I assign the Service Group Administrator Azure role?
Assign Service Group Administrator when you need to: Create and administer preview service groups and connect supported resources or groups through service relationships.; and Delegate one of the three Service Group roles while preserving the built-in role-definition condition.. Practical scope: The definition is assignable only under `/providers/Microsoft.Management/serviceGroups`, a tenant-level Service Groups provider hierarchy with one root service group. Access at a parent service group applies through connected child relationships; it is not an Azure management-group or subscription scope.
What permissions does the Service Group Administrator Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: *; Microsoft.Authorization/roleAssignments/write; and Microsoft.Authorization/roleAssignments/delete. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Service Group Administrator Azure role?
Key considerations when assigning Service Group Administrator: The wildcard Actions grant broad control in the Service Groups provider hierarchy.; and The ABAC condition limits role assignment to three Service Group roles but does not limit which principal receives an allowed role; scope and membership governance remain essential.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- What are Azure Service Groups? →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Delegate Azure role assignment management to others with conditions →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.