Skip to content

Commit ed97e13

Browse files
Xelu86Xelu86
committed
Freshness
1 parent fab86de commit ed97e13

1 file changed

Lines changed: 82 additions & 48 deletions

File tree

‎articles/sap/center-sap-solutions/manage-with-azure-rbac.md‎

Lines changed: 82 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,66 @@
11
---
2-
title: Manage Azure Center for SAP solutions resources with Azure RBAC
2+
title: Manage Azure Center for SAP solutions resources with Azure RBAC
33
description: Use Azure role-based access control (Azure RBAC) to manage access to your SAP workloads within Azure Center for SAP solutions.
4-
author: kalyaninamuduri
5-
ms.author: kanamudu
4+
author: kalyaninamuduri
5+
ms.author: kanamudu
66
ms.service: sap-on-azure
77
ms.subservice: center-sap-solutions
88
ms.topic: concept-article
99
ms.date: 02/03/2023
10-
ms.custom: template-concept
10+
ms.custom: template-concept
1111
# Customer intent: As an SAP system administrator, I want to manage access to SAP workloads using role-based access control, so that I can ensure effective permission management and security for deploying and managing SAP systems in Azure.
1212
---
1313

14-
# Management of Azure Center for SAP solutions resources with Azure RBAC
14+
# Management of Azure Center for SAP solutions resources with Azure RBAC
1515

16-
[Azure role-based access control (Azure RBAC)](../../role-based-access-control/overview.md) enables granular access management for Azure. You can use Azure RBAC to manage Virtual Instance for SAP solutions resources within Azure Center for SAP solutions. For example, you can separate duties within your team and grant only the amount of access that users need to perform their jobs.
16+
[Azure role-based access control (Azure RBAC)](../../role-based-access-control/overview.md) enables
17+
granular access management for Azure. You can use Azure RBAC to manage Virtual Instance for SAP
18+
solutions resources within Azure Center for SAP solutions. For example, you can separate duties
19+
within your team and grant only the amount of access that users need to perform their jobs.
1720

18-
*Users* or *user-assigned managed identities* require minimum roles or permissions to use the different capabilities in Azure Center for SAP solutions.
21+
*Users* or *user-assigned managed identities* require minimum roles or permissions to use the
22+
different capabilities in Azure Center for SAP solutions.
1923

20-
There are [Azure built-in roles](../../role-based-access-control/built-in-roles.md) for Azure Center for SAP solutions, or you can [create Azure custom roles](../../role-based-access-control/custom-roles.md) for more control. Azure Center for SAP solutions provides the following built-in roles to deploy and manage SAP systems on Azure:
24+
There are [Azure built-in roles](../../role-based-access-control/built-in-roles.md) for Azure Center
25+
for SAP solutions, or you can
26+
[create Azure custom roles](../../role-based-access-control/custom-roles.md) for more control. Azure
27+
Center for SAP solutions provides the following built-in roles to deploy and manage SAP systems on
28+
Azure:
2129

22-
- The **Azure Center for SAP solutions administrator** role has the required permissions for a user to deploy infrastructure, install SAP, and manage SAP systems from Azure Center for SAP solutions. The role allows users to:
30+
- The **Azure Center for SAP solutions administrator** role has the required permissions for a user
31+
to deploy infrastructure, install SAP, and manage SAP systems from Azure Center for SAP solutions.
32+
The role allows users to:
2333
- Deploy infrastructure for a new SAP system
2434
- Install SAP software
25-
- Register existing SAP systems as a [Virtual Instance for SAP solutions (VIS)](overview.md#what-is-a-virtual-instance-for-sap-solutions) resource.
35+
- Register existing SAP systems as a
36+
[Virtual Instance for SAP solutions (VIS)](overview.md#what-is-a-virtual-instance-for-sap-solutions)
37+
resource.
2638
- View the health and status of SAP systems.
2739
- Perform operations such as **Start** and **Stop** on the VIS resource.
28-
- Do all possible actions with Azure Center for SAP solutions, including the deletion of the VIS resource.
29-
- The **Azure Center for SAP solutions service role** is intended for use by the user-assigned managed identity. The Azure Center for SAP solutions service uses this identity to deploy and manage SAP systems. This role has permissions to support the deployment and management capabilities in Azure Center for SAP solutions.
40+
- Do all possible actions with Azure Center for SAP solutions, including the deletion of the VIS
41+
resource.
42+
- The **Azure Center for SAP solutions service role** is intended for use by the user-assigned
43+
managed identity. The Azure Center for SAP solutions service uses this identity to deploy and
44+
manage SAP systems. This role has permissions to support the deployment and management
45+
capabilities in Azure Center for SAP solutions.
3046
- The **Azure Center for SAP solutions reader** role has permissions to view all VIS resources.
3147

32-
> [!NOTE]
33-
> To use an existing user-assigned managed identity for deploying a new SAP system or registering an existing system, the user must also have the **Managed Identity Operator** role. This role is required to assign a user-assigned managed identity to the Virtual Instance for SAP solutions resource.
48+
> [!NOTE] To use an existing user-assigned managed identity for deploying a new SAP system or
49+
> registering an existing system, the user must also have the **Managed Identity Operator** role.
50+
> This role is required to assign a user-assigned managed identity to the Virtual Instance for SAP
51+
> solutions resource.
3452
35-
> [!NOTE]
36-
> If you're creating a new user-assigned managed identity when you deploy a new SAP system or register an existing system, the user must also have the **Managed Identity Contributor** and **Managed Identity Operator** roles. These roles are required to create a user-assigned identity, make necessary role assignments to it and assign it to the VIS resource.
53+
> [!NOTE] If you're creating a new user-assigned managed identity when you deploy a new SAP system
54+
> or register an existing system, the user must also have the **Managed Identity Contributor** and
55+
> **Managed Identity Operator** roles. These roles are required to create a user-assigned identity,
56+
> make necessary role assignments to it and assign it to the VIS resource.
3757
3858
## Deploy infrastructure for new SAP system
3959

40-
To deploy infrastructure for a new SAP system, a *user* and *user-assigned managed identity* requires the following role or permissions.
60+
To deploy infrastructure for a new SAP system, a *user* and *user-assigned managed identity*
61+
requires the following role or permissions.
4162

42-
| Built-in roles for *users* |
63+
| Built-in roles for *users* |
4364
| ------------------------- |
4465
| **Azure Center for SAP solutions administrator** |
4566
| **Managed Identity Operator** |
@@ -118,9 +139,10 @@ To deploy infrastructure for a new SAP system, a *user* and *user-assigned manag
118139

119140
## Install SAP software
120141

121-
To install SAP software, a *user* and *user-assigned managed identity* requires the following role or permissions.
142+
To install SAP software, a *user* and *user-assigned managed identity* requires the following role
143+
or permissions.
122144

123-
| Built-in roles for *users* |
145+
| Built-in roles for *users* |
124146
| ------------------------- |
125147
| **Azure Center for SAP solutions administrator** |
126148

@@ -178,9 +200,10 @@ To install SAP software, a *user* and *user-assigned managed identity* requires
178200

179201
## Register and manage existing SAP system
180202

181-
To register an existing SAP system and manage that system with Azure Center for SAP solutions, a *user* or *user-assigned managed identity* requires the following role or permissions.
203+
To register an existing SAP system and manage that system with Azure Center for SAP solutions, a
204+
*user* or *user-assigned managed identity* requires the following role or permissions.
182205

183-
| Built-in roles for *users* |
206+
| Built-in roles for *users* |
184207
| ------------------------- |
185208
| **Azure Center for SAP solutions administrator** |
186209
| **Managed Identity Operator** |
@@ -220,11 +243,12 @@ To register an existing SAP system and manage that system with Azure Center for
220243
| `Microsoft.Resources/subscriptions/resourcegroups/deployments/*` |
221244
| `Microsoft.Resources/tags/*` |
222245

223-
## View VIS resources
246+
## View VIS resources
224247

225-
To view VIS resources, a *user* or *user-assigned managed identity* requires the following role or permissions.
248+
To view VIS resources, a *user* or *user-assigned managed identity* requires the following role or
249+
permissions.
226250

227-
| Built-in roles for *users* |
251+
| Built-in roles for *users* |
228252
| ------------------------- |
229253
| **Azure Center for SAP solutions reader** |
230254

@@ -255,9 +279,10 @@ To view VIS resources, a *user* or *user-assigned managed identity* requires the
255279

256280
## Start SAP system
257281

258-
To start the SAP system from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
282+
To start the SAP system from a VIS resource, a *user* and *user-assigned managed identity* requires
283+
the following role or permissions.
259284

260-
| Built-in roles for *users* |
285+
| Built-in roles for *users* |
261286
| ------------------------- |
262287
| **Azure Center for SAP solutions administrator** |
263288

@@ -278,9 +303,10 @@ To start the SAP system from a VIS resource, a *user* and *user-assigned managed
278303

279304
## Stop SAP system
280305

281-
To stop the SAP system from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
306+
To stop the SAP system from a VIS resource, a *user* and *user-assigned managed identity* requires
307+
the following role or permissions.
282308

283-
| Built-in roles for *users* |
309+
| Built-in roles for *users* |
284310
| ------------------------- |
285311
| **Azure Center for SAP solutions administrator** |
286312

@@ -300,9 +326,10 @@ To stop the SAP system from a VIS resource, a *user* and *user-assigned managed
300326
| `Microsoft.Compute/virtualMachines/instanceView/read` |
301327

302328
## Start SAP Central services instance
303-
To start the SAP Central services instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
329+
To start the SAP Central services instance from a VIS resource, a *user* and *user-assigned managed
330+
identity* requires the following role or permissions.
304331

305-
| Built-in roles for *users* |
332+
| Built-in roles for *users* |
306333
| ------------------------- |
307334
| **Azure Center for SAP solutions administrator** |
308335

@@ -322,9 +349,10 @@ To start the SAP Central services instance from a VIS resource, a *user* and *us
322349
| `Microsoft.Compute/virtualMachines/instanceView/read` |
323350

324351
## Stop SAP Central services instance
325-
To stop the SAP Central services instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
352+
To stop the SAP Central services instance from a VIS resource, a *user* and *user-assigned managed
353+
identity* requires the following role or permissions.
326354

327-
| Built-in roles for *users* |
355+
| Built-in roles for *users* |
328356
| ------------------------- |
329357
| **Azure Center for SAP solutions administrator** |
330358

@@ -344,9 +372,10 @@ To stop the SAP Central services instance from a VIS resource, a *user* and *use
344372
| `Microsoft.Compute/virtualMachines/instanceView/read` |
345373

346374
## Start SAP Application server instance
347-
To start the SAP Application server instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
375+
To start the SAP Application server instance from a VIS resource, a *user* and *user-assigned
376+
managed identity* requires the following role or permissions.
348377

349-
| Built-in roles for *users* |
378+
| Built-in roles for *users* |
350379
| ------------------------- |
351380
| **Azure Center for SAP solutions administrator** |
352381

@@ -366,9 +395,10 @@ To start the SAP Application server instance from a VIS resource, a *user* and *
366395
| `Microsoft.Compute/virtualMachines/instanceView/read` |
367396

368397
## Stop SAP Application server instance
369-
To stop the SAP Application server instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
398+
To stop the SAP Application server instance from a VIS resource, a *user* and *user-assigned managed
399+
identity* requires the following role or permissions.
370400

371-
| Built-in roles for *users* |
401+
| Built-in roles for *users* |
372402
| ------------------------- |
373403
| **Azure Center for SAP solutions administrator** |
374404

@@ -388,9 +418,10 @@ To stop the SAP Application server instance from a VIS resource, a *user* and *u
388418
| `Microsoft.Compute/virtualMachines/instanceView/read` |
389419

390420
## Start SAP HANA Database instance
391-
To start the SAP HANA Database instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
421+
To start the SAP HANA Database instance from a VIS resource, a *user* and *user-assigned managed
422+
identity* requires the following role or permissions.
392423

393-
| Built-in roles for *users* |
424+
| Built-in roles for *users* |
394425
| ------------------------- |
395426
| **Azure Center for SAP solutions administrator** |
396427

@@ -410,9 +441,10 @@ To start the SAP HANA Database instance from a VIS resource, a *user* and *user-
410441
| `Microsoft.Compute/virtualMachines/instanceView/read` |
411442

412443
## Stop SAP HANA Database instance
413-
To stop the SAP HANA Database instance from a VIS resource, a *user* and *user-assigned managed identity* requires the following role or permissions.
444+
To stop the SAP HANA Database instance from a VIS resource, a *user* and *user-assigned managed
445+
identity* requires the following role or permissions.
414446

415-
| Built-in roles for *users* |
447+
| Built-in roles for *users* |
416448
| ------------------------- |
417449
| **Azure Center for SAP solutions administrator** |
418450

@@ -435,15 +467,15 @@ To stop the SAP HANA Database instance from a VIS resource, a *user* and *user-a
435467

436468
To view the cost analysis, a *user* requires the following role or permissions.
437469

438-
| Built-in roles for *users* |
470+
| Built-in roles for *users* |
439471
| ------------------------- |
440472
| **Cost Management Reader** |
441473

442474
| Minimum permissions for *users* |
443475
| ------------------------------- |
444476
| `Microsoft.Consumption/*/read**` |
445477
| `Microsoft.CostManagement/*/read` |
446-
| `Microsoft.Billing/billingPeriods/read` |
478+
| `Microsoft.Billing/billingPeriods/read` |
447479
| `Microsoft.Resources/subscriptions/read` |
448480
| `Microsoft.Resources/subscriptions/resourceGroups/read` |
449481
| `Microsoft.Billing/billingProperty/read` |
@@ -460,7 +492,7 @@ To view the cost analysis, a *user* requires the following role or permissions.
460492

461493
To view Quality Insights, a *user* requires the following role or permissions.
462494

463-
| Built-in roles for *users* |
495+
| Built-in roles for *users* |
464496
| ------------------------- |
465497
| **Azure Center for SAP solutions reader** |
466498

@@ -478,9 +510,10 @@ To view Quality Insights, a *user* requires the following role or permissions.
478510

479511
## Set up Azure Monitor for SAP solutions
480512

481-
To set up Azure Monitor for SAP solutions for your SAP resources, a *user* requires the following role or permissions.
513+
To set up Azure Monitor for SAP solutions for your SAP resources, a *user* requires the following
514+
role or permissions.
482515

483-
| Built-in roles for *users* |
516+
| Built-in roles for *users* |
484517
| ------------------------- |
485518
| **Contributor** |
486519

@@ -498,9 +531,10 @@ To set up Azure Monitor for SAP solutions for your SAP resources, a *user* requi
498531

499532
## Delete VIS resource
500533

501-
To delete a VIS resource, a *user* or *user-assigned managed identity* requires the following role or permissions.
534+
To delete a VIS resource, a *user* or *user-assigned managed identity* requires the following role
535+
or permissions.
502536

503-
| Built-in roles for *users* |
537+
| Built-in roles for *users* |
504538
| ------------------------- |
505539
| **Azure Center for SAP solutions administrator** |
506540

0 commit comments

Comments
 (0)