Azure Management and governance built-in role

Service Group Administrator

Preview role that manages all aspects of Azure Service Groups and relationships and is assigned by default to a user who creates a service group. It also creates and deletes role assignments, but an ABAC condition restricts delegation to the Service Group Administrator, Contributor, and Reader role definition IDs.

Control-plane actions (3)

• *
• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (2)

• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97}))

Assignable scopes (1)

• /providers/Microsoft.Management/serviceGroups

Practical scope

The definition is assignable only under `/providers/Microsoft.Management/serviceGroups`, a tenant-level Service Groups provider hierarchy with one root service group. Access at a parent service group applies through connected child relationships; it is not an Azure management-group or subscription scope.

Common use cases (2)

• Create and administer preview service groups and connect supported resources or groups through service relationships.
• Delegate one of the three Service Group roles while preserving the built-in role-definition condition.

Prerequisites (2)

• Use the Service Groups preview and initialize the tenant root service group.
• Root access requires tenant-level role-assignment write authority; Microsoft notes a Global Administrator can elevate Azure access for that task, but the Entra role is not duplicated here.

Best practices (2)

• Preserve the built-in ABAC condition and assign below the root whenever tenant-wide administration is unnecessary.
• Treat Service Groups and custom RBAC limitations as preview constraints and review the feature before production dependency.

Security considerations (2)

• The wildcard Actions grant broad control in the Service Groups provider hierarchy.
• The ABAC condition limits role assignment to three Service Group roles but does not limit which principal receives an allowed role; scope and membership governance remain essential.

Assignment guidance

Assign at the specific service group to its governance administrator. Use root scope only for tenant service-group administrators, retain the condition, and use Contributor when role delegation is unnecessary.

Related roles (2)

• Service Group Contributor: Manages service groups and relationships without role assignment authority.
• Service Group Reader: Read-only view of service groups and relationships.

Editorial sources (6)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• What are Azure Service Groups? →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Delegate Azure role assignment management to others with conditions →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →