You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sap/center-sap-solutions/manage-with-azure-rbac.md
+56-50Lines changed: 56 additions & 50 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,43 +1,44 @@
1
1
---
2
-
title: Manage Azure Center for SAP solutions resources with Azure RBAC
3
-
description: Use Azure role-based access control (Azure RBAC) to manage access to your SAP workloads within Azure Center for SAP solutions.
4
-
author: kalyaninamuduri
5
-
ms.author: kanamudu
2
+
title: Azure RBAC for Azure Center for SAP solutions resources
3
+
description: Learn how Azure role-based access control (Azure RBAC) manages access to SAP workloads in Azure Center for SAP solutions, including built-in roles and minimum permissions.
4
+
author: kalyaninamuduri
5
+
ms.author: kanamudu
6
6
ms.service: sap-on-azure
7
7
ms.subservice: center-sap-solutions
8
8
ms.topic: concept-article
9
-
ms.date: 02/03/2023
10
-
ms.custom: template-concept
9
+
ms.date: 04/08/2026
10
+
ms.custom: template-concept
11
11
# Customer intent: As an SAP system administrator, I want to manage access to SAP workloads using role-based access control, so that I can ensure effective permission management and security for deploying and managing SAP systems in Azure.
12
12
---
13
13
14
-
# Management of Azure Center for SAP solutions resources with Azure RBAC
14
+
# Azure RBAC for Azure Center for SAP solutions
15
15
16
-
[Azure role-based access control (Azure RBAC)](../../role-based-access-control/overview.md)enables granular access management for Azure. You can use Azure RBAC to manage Virtual Instance for SAP solutions resources within Azure Center for SAP solutions. For example, you can separate duties within your team and grant only the amount of access that users need to perform their jobs.
16
+
Azure [role-based access control (RBAC)](../../role-based-access-control/overview.md)lets you separate duties within your team and grant only the permissions users need to deploy and manage SAP systems in Azure Center for SAP solutions. Users or user-assigned managed identities require specific roles or minimum permissions for each capability.
17
17
18
-
*Users* or *user-assigned managed identities* require minimum roles or permissions to use the different capabilities in Azure Center for SAP solutions.
18
+
This article lists the built-in roles and minimum permissions that users and user-assigned managed identities need for each Azure Center for SAP solutions capability.
19
19
20
-
There are [Azure built-in roles](../../role-based-access-control/built-in-roles.md) for Azure Center for SAP solutions, or you can [create Azure custom roles](../../role-based-access-control/custom-roles.md) for more control. Azure Center for SAP solutions provides the following built-in roles to deploy and manage SAP systems on Azure:
20
+
## Built-in roles
21
+
22
+
Use [Azure built-in roles](../../role-based-access-control/built-in-roles.md) for Azure Center for SAP solutions, or [create Azure custom roles](../../role-based-access-control/custom-roles.md) for more control. Azure Center for SAP solutions provides the following built-in roles to deploy and manage SAP systems on Azure:
21
23
22
24
- The **Azure Center for SAP solutions administrator** role has the required permissions for a user to deploy infrastructure, install SAP, and manage SAP systems from Azure Center for SAP solutions. The role allows users to:
23
-
- Deploy infrastructure for a new SAP system
24
-
- Install SAP software
25
-
- Register existing SAP systems as a [Virtual Instance for SAP solutions (VIS)](overview.md#what-is-a-virtual-instance-for-sap-solutions) resource.
26
-
- View the health and status of SAP systems.
27
-
- Perform operations such as **Start** and **Stop** on the VIS resource.
28
-
- Do all possible actions with Azure Center for SAP solutions, including the deletion of the VIS resource.
25
+
- Deploy infrastructure for a new SAP system.
26
+
- Install SAP software.
27
+
- Register existing SAP systems as a [Virtual Instance for SAP solutions (VIS)](overview.md#what-is-a-virtual-instance-for-sap-solutions) resource.
28
+
- View the health and status of SAP systems.
29
+
- Perform operations such as **Start** and **Stop** on the VIS resource.
30
+
- Perform all actions available in Azure Center for SAP solutions, including the deletion of the VIS resource.
29
31
- The **Azure Center for SAP solutions service role** is intended for use by the user-assigned managed identity. The Azure Center for SAP solutions service uses this identity to deploy and manage SAP systems. This role has permissions to support the deployment and management capabilities in Azure Center for SAP solutions.
30
32
- The **Azure Center for SAP solutions reader** role has permissions to view all VIS resources.
31
33
32
34
> [!NOTE]
33
-
> To use an existing user-assigned managed identity for deploying a new SAP system or registering an existing system, the user must also have the **Managed Identity Operator** role. This role is required to assign a user-assigned managed identity to the Virtual Instance for SAP solutions resource.
34
-
35
-
> [!NOTE]
36
-
> If you're creating a new user-assigned managed identity when you deploy a new SAP system or register an existing system, the user must also have the **Managed Identity Contributor** and **Managed Identity Operator** roles. These roles are required to create a user-assigned identity, make necessary role assignments to it and assign it to the VIS resource.
35
+
> To use an existing user-assigned managed identity for deploying a new SAP system or registering an existing system, you must also have the **Managed Identity Operator** role. This role is required to assign a user-assigned managed identity to the Virtual Instance for SAP solutions resource.
36
+
>
37
+
> If you're creating a new user-assigned managed identity when you deploy a new SAP system or register an existing system, you must also have the **Managed Identity Contributor** and **Managed Identity Operator** roles. These roles are required to create a user-assigned identity, make necessary role assignments to it, and assign it to the VIS resource.
37
38
38
39
## Deploy infrastructure for new SAP system
39
40
40
-
To deploy infrastructure for a new SAP system, a *user* and *user-assigned managed identity*requires the following role or permissions.
41
+
To deploy infrastructure for a new SAP system, a *user* and *user-assigned managed identity*require the following role or permissions.
41
42
42
43
| Built-in roles for *users*|
43
44
| ------------------------- |
@@ -60,15 +61,14 @@ To deploy infrastructure for a new SAP system, a *user* and *user-assigned manag
@@ -118,7 +118,7 @@ To deploy infrastructure for a new SAP system, a *user* and *user-assigned manag
118
118
119
119
## Install SAP software
120
120
121
-
To install SAP software, a *user* and *user-assigned managed identity*requires the following role or permissions.
121
+
To install SAP software, a *user* and *user-assigned managed identity*require the following role or permissions.
122
122
123
123
| Built-in roles for *users*|
124
124
| ------------------------- |
@@ -178,7 +178,7 @@ To install SAP software, a *user* and *user-assigned managed identity* requires
178
178
179
179
## Register and manage existing SAP system
180
180
181
-
To register an existing SAP system and manage that system with Azure Center for SAP solutions, a *user* or *user-assigned managed identity* requires the following role or permissions.
181
+
To register an existing SAP system and manage that system with Azure Center for SAP solutions, a *user* or *user-assigned managed identity* requires the following role or permissions.
182
182
183
183
| Built-in roles for *users*|
184
184
| ------------------------- |
@@ -247,15 +247,15 @@ To view VIS resources, a *user* or *user-assigned managed identity* requires the
247
247
248
248
| Built-in roles for *user-assigned managed identities*|
To start the SAP Central services instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
303
+
304
+
To start the SAP Central services instance from a VIS resource, a *user* and *user-assigned managed identity* require the following role or permissions.
304
305
305
306
| Built-in roles for *users*|
306
307
| ------------------------- |
@@ -322,7 +323,8 @@ To start the SAP Central services instance from a VIS resource, a *user* and *us
To stop the SAP Central services instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
326
+
327
+
To stop the SAP Central services instance from a VIS resource, a *user* and *user-assigned managed identity* require the following role or permissions.
326
328
327
329
| Built-in roles for *users*|
328
330
| ------------------------- |
@@ -343,8 +345,9 @@ To stop the SAP Central services instance from a VIS resource, a *user* and *use
To start the SAP Application server instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
348
+
## Start SAP application server instance
349
+
350
+
To start the SAP application server instance from a VIS resource, a *user* and *user-assigned managed identity* require the following role or permissions.
348
351
349
352
| Built-in roles for *users*|
350
353
| ------------------------- |
@@ -365,8 +368,9 @@ To start the SAP Application server instance from a VIS resource, a *user* and *
To stop the SAP Application server instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
371
+
## Stop SAP application server instance
372
+
373
+
To stop the SAP application server instance from a VIS resource, a *user* and *user-assigned managed identity* require the following role or permissions.
370
374
371
375
| Built-in roles for *users*|
372
376
| ------------------------- |
@@ -387,8 +391,9 @@ To stop the SAP Application server instance from a VIS resource, a *user* and *u
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments