Skip to content

Commit e063eee

Browse files
author
Rich Thorn
committed
Final updates, added RBAC, and Portal Create
1 parent b715272 commit e063eee

File tree

3 files changed

+130
-2
lines changed

3 files changed

+130
-2
lines changed

‎articles/governance/service-groups/create-service-group-rest-api.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: "Quickstart: Create a service group with REST API"
3+
title: "Quickstart: Create a service group with REST API"
34
description: In this quickstart, you use REST API to create a service group to organize your resources.
45
author: rthorn17
56
ms.author: rithorn

‎articles/governance/service-groups/manage-service-groups.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: Manage resources across subscriptions and resource groups with Azure Service Groups
3+
title: Manage resources across subscriptions and resource groups with Azure Service Groups
34
description: "Learn how to create, update, read, and delete Azure Service Groups and members"
45
author: rthorn17
56
ms.author: rithorn

‎articles/governance/service-groups/overview.md

Lines changed: 128 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ms.date: 05/19/2025
1010

1111
# What are Azure Service Groups?
1212

13-
Service groups in Azure are a low-privilege-based grouping of resources across subscriptions. They provide a way to manage resources with minimal permissions, ensuring that resources can be grouped and managed without granting excessive access. Service Groups are designed to complement existing organizational structures like Resource Groups, Subscriptions, and Management Groups by offering a flexible and secure way to aggregate resources for specific purposes. This article helps give you an overview of what Service Groups are, the scenarios to use them for, and provide guidance on how to get started.
13+
Azure Service Groups offer a flexible way to organize and manage resources across subscriptions and resource groups, parallel to any existing Azure resource hierarchy. They are ideal for scenarios requiring cross-boundary grouping, minimal permissions, and aggregations of data across resources. These features empower teams to create tailored resource collections that align with operational, organizational, or persona-based needs. This article helps give you an overview of what Service Groups are, the scenarios to use them for, and provide guidance on how to get started.
1414

1515
> [!IMPORTANT]
1616
> Azure Service Groups is currently in PREVIEW.
@@ -97,7 +97,133 @@ Service Groups creates the Root Service Group on the first request received with
9797
/providers/microsoft.management/servicegroups/<tenantId>
9898
```
9999

100-
Access to the root has to be given from a user with "microsoft.authorization/roleassignments/write" permissions at the tenant level. For example, the Tenant's Global Administrator can elevate their access on the tenant to have these permissions. [Details on elevating Tenant Global Administrator Accesses](/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs)
100+
Access to the root has to be given from a user with "microsoft.authorization/roleassignments/write" permissions at the tenant level. For example, the Tenant's Global Administrator can elevate their access on the tenant to have these permissions. [Details on elevating Tenant Global Administrator Accesses](https://learn.microsoft.com/en-us/azure/
101+
role-based-access-control/elevate-access-global-admin?tabs=azure-portal%2Centra-audit-logs)
102+
103+
### Role Based Access Controls
104+
Three built in roles have been created to support Service Groups in the preview.
105+
106+
> [!NOTE]
107+
> Custom Role Based Access Controls (RBAC) are not supported within the Preview.
108+
109+
#### Service Group Administrator
110+
This role has been created to mange all aspects of Service Groups and Relationships. It will only allow the assignment of Service Group Roles to other Service Groups.
111+
112+
**ID**: '/providers/Microsoft.Authorization/roleDefinitions/4e50c84c-c78e-4e37-b47e-e60ffea0a775"
113+
114+
```json
115+
{
116+
"assignableScopes": [
117+
"/providers/Microsoft.Management/serviceGroups"
118+
],
119+
"createdBy": null,
120+
"createdOn": "2024-10-15T18:15:20.488676+00:00",
121+
"description": "Role Definition for administrator of a Service Group",
122+
"id": "/providers/Microsoft.Authorization/roleDefinitions/4e50c84c-c78e-4e37-b47e-e60ffea0a775",
123+
"name": "4e50c84c-c78e-4e37-b47e-e60ffea0a775",
124+
"permissions": [
125+
{
126+
"actions": [
127+
"*"
128+
],
129+
"condition": null,
130+
"conditionVersion": null,
131+
"dataActions": [],
132+
"notActions": [
133+
"Microsoft.Authorization/roleAssignments/write",
134+
"Microsoft.Authorization/roleAssignments/delete"
135+
],
136+
"notDataActions": []
137+
},
138+
{
139+
"actions": [
140+
"Microsoft.Authorization/roleAssignments/write",
141+
"Microsoft.Authorization/roleAssignments/delete"
142+
],
143+
"condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{4e50c84cc78e4e37b47ee60ffea0a775,32e6a4ec60954e37b54b12aa350ba81f,de754d53652d4c75a67f1e48d8b49c97}))",
144+
"conditionVersion": "2.0",
145+
"dataActions": [],
146+
"notActions": [],
147+
"notDataActions": []
148+
}
149+
],
150+
"roleName": "Service Group Administrator",
151+
"roleType": "BuiltInRole",
152+
"type": "Microsoft.Authorization/roleDefinitions",
153+
"updatedBy": null,
154+
"updatedOn": "2025-03-25T18:40:31.229386+00:00"
155+
}
156+
```
157+
#### Service Group Contributor
158+
The Service Group Contributor role is the default built-in role given to users when they create a new Service Group. This role allows fro all actions except for Role Assignment capabilities.
159+
```json
160+
{
161+
"assignableScopes": [
162+
"/providers/Microsoft.Management/serviceGroups"
163+
],
164+
"createdBy": null,
165+
"createdOn": "2024-10-15T18:15:20.488676+00:00",
166+
"description": "Role Definition for contributor of a Service Group",
167+
"id": "/providers/Microsoft.Authorization/roleDefinitions/32e6a4ec-6095-4e37-b54b-12aa350ba81f",
168+
"name": "32e6a4ec-6095-4e37-b54b-12aa350ba81f",
169+
"permissions": [
170+
{
171+
"actions": [
172+
"*"
173+
],
174+
"condition": null,
175+
"conditionVersion": null,
176+
"dataActions": [],
177+
"notActions": [
178+
"Microsoft.Authorization/roleAssignments/write",
179+
"Microsoft.Authorization/roleAssignments/delete"
180+
],
181+
"notDataActions": []
182+
}
183+
],
184+
"roleName": "Service Group Contributor",
185+
"roleType": "BuiltInRole",
186+
"type": "Microsoft.Authorization/roleDefinitions",
187+
"updatedBy": null,
188+
"updatedOn": "2024-10-15T18:15:20.488676+00:00"
189+
}
190+
```
191+
192+
193+
### Service Group Reader
194+
This built-in role is to be used to read service groups and can also be assigned to other resources to view the connected relationships.
195+
196+
```json
197+
{
198+
"assignableScopes": [
199+
"/"
200+
],
201+
"createdBy": null,
202+
"createdOn": "2024-10-15T18:15:20.487675+00:00",
203+
"description": "Role Definition for reader of a Service Group",
204+
"id": "/providers/Microsoft.Authorization/roleDefinitions/de754d53-652d-4c75-a67f-1e48d8b49c97",
205+
"name": "de754d53-652d-4c75-a67f-1e48d8b49c97",
206+
"permissions": [
207+
{
208+
"actions": [
209+
"Microsoft.Management/serviceGroups/read",
210+
"Microsoft.Authorization/*/read"
211+
],
212+
"condition": null,
213+
"conditionVersion": null,
214+
"dataActions": [],
215+
"notActions": [],
216+
"notDataActions": []
217+
}
218+
],
219+
"roleName": "Service Group Reader",
220+
"roleType": "BuiltInRole",
221+
"type": "Microsoft.Authorization/roleDefinitions",
222+
"updatedBy": null,
223+
"updatedOn": "2024-10-15T18:15:20.487675+00:00"
224+
}
225+
```
226+
101227

102228

103229
## Related content

0 commit comments

Comments
 (0)