Skip to content

Commit 5aeacd7

Browse files
jenniferf-skcjenniferf-skc
committed
Adding Service Group roles
1 parent 4587235 commit 5aeacd7

File tree

2 files changed

+159
-2
lines changed

2 files changed

+159
-2
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: jenniferf-skc
88
manager: pmwongera
99
ms.author: jfields
10-
ms.date: 07/07/2025
10+
ms.date: 07/18/2025
1111
ms.custom: generated
1212
---
1313

@@ -560,6 +560,9 @@ The following table provides a brief description of each built-in role. Click th
560560
> | <a name='resource-policy-contributor'></a>[Resource Policy Contributor](./built-in-roles/management-and-governance.md#resource-policy-contributor) | Users with rights to create/modify resource policy, create support ticket and read resources/hierarchy. | 36243c78-bf99-498c-9df9-86d9f8d28608 |
561561
> | <a name='savings-plan-purchaser'></a>[Savings plan Purchaser](./built-in-roles/management-and-governance.md#savings-plan-purchaser) | Lets you purchase savings plans | 3d24a3a0-c154-4f6f-a5ed-adc8e01ddb74 |
562562
> | <a name='scheduled-patching-contributor'></a>[Scheduled Patching Contributor](./built-in-roles/management-and-governance.md#scheduled-patching-contributor) | Provides access to manage maintenance configurations with maintenance scope InGuestPatch and corresponding configuration assignments | cd08ab90-6b14-449c-ad9a-8f8e549482c6 |
563+
> | <a name='service-group-administrator'></a>[Service Group Administrator](./built-in-roles/management-and-governance.md#service-group-administrator) | Manage all aspects of service groups and relationships. The default role assigned to users when they create a service group. Includes an ABAC condition to constrain role assignments. | 4e50c84c-c78e-4e37-b47e-e60ffea0a775 |
564+
> | <a name='service-group-contributor'></a>[Service Group Contributor](./built-in-roles/management-and-governance.md#service-group-contributor) | Manage all aspects of service groups and relationships, but does not allow you to assign roles. | 32e6a4ec-6095-4e37-b54b-12aa350ba81f |
565+
> | <a name='service-group-reader'></a>[Service Group Reader](./built-in-roles/management-and-governance.md#service-group-reader) | Read service groups and view the connected relationships. | de754d53-652d-4c75-a67f-1e48d8b49c97
563566
> | <a name='site-recovery-contributor'></a>[Site Recovery Contributor](./built-in-roles/management-and-governance.md#site-recovery-contributor) | Lets you manage Site Recovery service except vault creation and role assignment | 6670b86e-a3f7-4917-ac9b-5d6ab1be4567 |
564567
> | <a name='site-recovery-operator'></a>[Site Recovery Operator](./built-in-roles/management-and-governance.md#site-recovery-operator) | Lets you failover and failback but not perform other Site Recovery management operations | 494ae006-db33-4328-bf46-533a6560a3ca |
565568
> | <a name='site-recovery-reader'></a>[Site Recovery Reader](./built-in-roles/management-and-governance.md#site-recovery-reader) | Lets you view Site Recovery status but not perform other management operations | dbaa88c4-0c30-4179-9fb3-46319faa6149 |

‎articles/role-based-access-control/built-in-roles/management-and-governance.md

Lines changed: 155 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.workload: identity
77
author: jenniferf-skc
88
manager: pmwongera
99
ms.author: jfields
10-
ms.date: 05/25/2025
10+
ms.date: 07/18/2025
1111
ms.custom: generated
1212
---
1313

@@ -2222,6 +2222,160 @@ Provides access to manage maintenance configurations with maintenance scope InGu
22222222
"type": "Microsoft.Authorization/roleDefinitions"
22232223
}
22242224
```
2225+
## Service Group Administrator
2226+
2227+
Manage all aspects of service groups and relationships. The default role assigned to users when they create a service group. Includes an ABAC condition to constrain role assignments.
2228+
2229+
[Learn more](/azure/governance/service-groups/overview)
2230+
2231+
> [!div class="mx-tableFixed"]
2232+
> | Actions | Description |
2233+
> | --- | --- |
2234+
> | * | |
2235+
> | **NotActions** | |
2236+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
2237+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
2238+
> | **DataActions** | |
2239+
> | *none* | |
2240+
> | **NotDataActions** | |
2241+
> | *none* | |
2242+
> | **Actions** | |
2243+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
2244+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
2245+
> | **NotActions** | |
2246+
> | *none* | |
2247+
> | **DataActions** | |
2248+
> | *none* | |
2249+
> | **NotDataActions** | |
2250+
> | *none* | |
2251+
> | **Condition** | |
2252+
> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97})) | Add or remove role assignments for the following roles:<br/>Service Group Administrator<br/>Service Group Contributor<br/>Service Group Reader |
2253+
2254+
```json
2255+
{
2256+
"assignableScopes": [
2257+
"/providers/Microsoft.Management/serviceGroups"
2258+
],
2259+
"description": "Role Definition for administrator of a Service Group",
2260+
"id": "/providers/Microsoft.Authorization/roleDefinitions/4e50c84c-c78e-4e37-b47e-e60ffea0a775",
2261+
"name": "4e50c84c-c78e-4e37-b47e-e60ffea0a775",
2262+
"permissions": [
2263+
{
2264+
"actions": [
2265+
"*"
2266+
],
2267+
"notActions": [
2268+
"Microsoft.Authorization/roleAssignments/write",
2269+
"Microsoft.Authorization/roleAssignments/delete"
2270+
],
2271+
"dataActions": [],
2272+
"notDataActions": []
2273+
},
2274+
{
2275+
"actions": [
2276+
"Microsoft.Authorization/roleAssignments/write",
2277+
"Microsoft.Authorization/roleAssignments/delete"
2278+
],
2279+
"notActions": [],
2280+
"dataActions": [],
2281+
"notDataActions": [],
2282+
"conditionVersion": "2.0",
2283+
"condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97}))"
2284+
}
2285+
],
2286+
"roleName": "Service Group Administrator",
2287+
"roleType": "BuiltInRole",
2288+
"type": "Microsoft.Authorization/roleDefinitions"
2289+
}
2290+
```
2291+
2292+
## Service Group Contributor
2293+
2294+
Manage all aspects of service groups and relationships, but does not allow you to assign roles.
2295+
2296+
[Learn more](/azure/governance/service-groups/overview)
2297+
2298+
> [!div class="mx-tableFixed"]
2299+
> | Actions | Description |
2300+
> | --- | --- |
2301+
> | * | |
2302+
> | **NotActions** | |
2303+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
2304+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
2305+
> | **DataActions** | |
2306+
> | *none* | |
2307+
> | **NotDataActions** | |
2308+
> | *none* | |
2309+
2310+
```json
2311+
{
2312+
"assignableScopes": [
2313+
"/providers/Microsoft.Management/serviceGroups"
2314+
],
2315+
"description": "Role Definition for contributor of a Service Group",
2316+
"id": "/providers/Microsoft.Authorization/roleDefinitions/32e6a4ec-6095-4e37-b54b-12aa350ba81f",
2317+
"name": "32e6a4ec-6095-4e37-b54b-12aa350ba81f",
2318+
"permissions": [
2319+
{
2320+
"actions": [
2321+
"*"
2322+
],
2323+
"notActions": [
2324+
"Microsoft.Authorization/roleAssignments/write",
2325+
"Microsoft.Authorization/roleAssignments/delete"
2326+
],
2327+
"dataActions": [],
2328+
"notDataActions": []
2329+
}
2330+
],
2331+
"roleName": "Service Group Contributor",
2332+
"roleType": "BuiltInRole",
2333+
"type": "Microsoft.Authorization/roleDefinitions"
2334+
}
2335+
```
2336+
2337+
## Service Group Reader
2338+
2339+
Read service groups and view the connected relationships.
2340+
2341+
[Learn more](/azure/governance/service-groups/overview)
2342+
2343+
> [!div class="mx-tableFixed"]
2344+
> | Actions | Description |
2345+
> | --- | --- |
2346+
> | */read | Read control plane information for all Azure resources. |
2347+
> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
2348+
> | **NotActions** | |
2349+
> | *none* | |
2350+
> | **DataActions** | |
2351+
> | *none* | |
2352+
> | **NotDataActions** | |
2353+
> | *none* | |
2354+
2355+
```json
2356+
{
2357+
"assignableScopes": [
2358+
"/providers/Microsoft.Management/serviceGroups"
2359+
],
2360+
"description": "Role Definition for reader of a Service Group",
2361+
"id": "/providers/Microsoft.Authorization/roleDefinitions/de754d53-652d-4c75-a67f-1e48d8b49c97",
2362+
"name": "de754d53-652d-4c75-a67f-1e48d8b49c97",
2363+
"permissions": [
2364+
{
2365+
"actions": [
2366+
"*/read",
2367+
"Microsoft.Authorization/*/read"
2368+
],
2369+
"notActions": [],
2370+
"dataActions": [],
2371+
"notDataActions": []
2372+
}
2373+
],
2374+
"roleName": "Service Group Reader",
2375+
"roleType": "BuiltInRole",
2376+
"type": "Microsoft.Authorization/roleDefinitions"
2377+
}
2378+
```
22252379

22262380
## Site Recovery Contributor
22272381

0 commit comments

Comments
 (0)