If you are setting up the landing zone itself, start with SAP Azure Landing Zone Architecture; for the broader cost-and-governance context see RISE with SAP Cost Optimization, and wire the Entra ID side of the Joule/M365 Copilot integration per SAP Joule + M365 Copilot on Azure.

SAP on Azure: The RBAC & Governance Matrix You Can Copy

Most SAP-on-Azure incidents we review after the fact are not exotic zero-days. They are a Basis consultant who kept a subscription-wide Contributor “from the migration project”, or a backup role that was never scoped down. This article turns “who should have what” into a table you can copy, adapt, and audit. Every role name and role definition ID below was verified against Microsoft’s published built-in role catalog on 2026-11-08; where a claim could not be verified from public documentation, we say so explicitly.

Two design principles drive the matrix, both grounded in Microsoft’s own SAP guidance: the Azure security baseline for SAP workloads is framed as Zero Trust and calls for stronger segregation of duties among SAP Basis, backup, server team, and security/key management [3], and the SAP landing-zone security guidance recommends Microsoft Entra PIM so privileged roles are active only when needed — for example to start or stop a VM — with request/approval, logging and auditing [6].

The scope hierarchy, and where it bites

Azure RBAC has four scope levels — management group, subscription, resource group, resource — and role assignments inherit downward [8]. The traps are in the details, each verified in the linked docs:

• PIM role settings (aka “PIM policies”) do not inherit: settings at Subscription scope are not inherited by Resource Groups; they are per role, per resource [5].
• Managing PIM settings requires Owner or User Access Administrator at that scope — the very roles this article rations out carefully [5].
• A custom role containing DataActions (data plane: blob contents, Key Vault secrets) cannot be assigned at management-group scope; the documented workaround is one management group in AssignableScopes, then assign per subscription under it [2].
• No wildcards in AssignableScopes — a guardrail against a role definition being widened later [2].

graph TD
    MG["MG: contoso-sap-root"]
    PROD["Subscription: sap-prod"]
    DEV["Subscription: sap-dev"]
    RGDB["RG: sap-prod-db"]
    RGAPP["RG: sap-prod-app"]
    RGNET["RG: sap-prod-net"]
    VM["HANA/PAS VMs"]
    RSV["Recovery Services vault"]
    KV["Key Vault (RBAC model)"]
    ST["Storage (backups, media)"]
    MG --> PROD
    MG --> DEV
    PROD --> RGDB
    PROD --> RGAPP
    PROD --> RGNET
    RGDB --> VM
    RGDB --> RSV
    RGDB --> KV
    RGAPP --> ST
    VM -.->|"Actions = control plane; data plane needs DataActions"| KV

An assignment at MG cascades to every resource beneath it. That is why “Reader at management group” is a sane auditor scope and “Contributor at management group” is a tenant-wide incident waiting to happen.

The four teams

Team	Legitimate need	Typical failure mode
Platform / landing-zone	Deploy infrastructure (VNet, RG, policies), grant access, cost governance	Becomes permanent Owner of everything
SAP Basis	Day-2 ops: power cycle, patch coordination, start/stop via Azure Center for SAP solutions, OS credentials from Key Vault	Takes VM Contributor “for restarts”, gains root via extensions
DBA (HANA/SQL/Oracle)	Log in to DB hosts, read/export backup data, never touch network or IAM	Gets Storage Account Contributor “to reach the backup container”
Security / audit	Read IAM, security posture, logs, backup state, vault metadata — change nothing	Gets Security Administrator to “dismiss false positives”

The matrix

Minimal built-in combinations. PIM: = assign eligible, not active, behind an activation workflow. Assumptions: sap-prod subscription, RGs per domain, vaults in Azure RBAC permission model [3][4][6].

Scope / resource	Platform	SAP Basis	DBA	Security/Audit
Subscription	Reader (always) + Contributor (PIM, deploy windows); Support Request Contributor; Cost Management Reader	Reader	Reader	Reader + Security Reader (always active)
Resource group	Contributor per domain RG via PIM	Custom Basis role or VM Contributor (PIM) on app RG	Custom role / VM User Login on db RG	Reader on all RGs
VNet / subnets / PE	Network Contributor on net RG	Network Contributor only if Basis owns NSG rules for SAP ports; else Reader	Reader	Reader
Compute (SAP VMs)	VM Contributor via PIM	Power-operator custom role (below); VM Administrator Login via PIM only	VM User Login (active); VM Administrator Login (PIM); Data Operator for Managed Disks for offline disk export	Reader + Monitoring Reader
Storage	Storage Account Contributor (PIM)	Storage Blob Data Reader on script shares; never account-key roles	Blob Data Reader/Contributor (PIM) on backup container	Reader
Backup vault	Backup Contributor (PIM) for vault changes	Backup Operator + Storage Account Backup Contributor; read-only to vault is Microsoft’s ransomware guidance for SAP/server admins [3]	Backup Reader; Backup Operator (PIM) for restores	Backup Reader
Key Vault	Key Vault Contributor (vault CRUD) + Key Vault Data Access Administrator (grant data roles)	Key Vault Secrets User (OS/service creds live in vault per baseline [3])	Key Vault Secrets User on DB-credential vault only	Key Vault Reader (metadata; cannot read values [1])
Monitor / LA	Log Analytics Contributor (PIM)	Monitoring Reader; Log Analytics Reader	Log Analytics Data Reader	Log Analytics Reader + Monitoring Reader
ACSS / VIS	ACSS Administrator (PIM, deploy) + Managed Identity Operator	ACSS Administrator on VIS + Managed Identity Operator (MI Contributor if UAI is created)	ACSS Reader	Reader
Sentinel / Defender	—	—	—	Security Reader + Sentinel Contributor

Built-in role quick reference (verified IDs, 2026-11-08)

All IDs taken from the raw markdown of the official catalog (doc dated 2026-09-10) [1]:

Role	Role definition ID	Why this scope
Reader	acdd72a7-3385-48ef-bd42-f606fba81ae7	Control-plane read only
Contributor	b24988ac-6180-42a0-ab88-20f7382dd24c	Manages all except access
Owner	8e3af657-a8ff-443c-a75c-2fe8c4bcb635	Contributor + grants access — avoid at subscription
User Access Administrator	18d7d88d-d35e-4fb5-a5c3-7773c20a72d9	Mints permissions; PIM + break-glass only
Role Based Access Control Administrator	f58310d9-a9f6-439a-9e8d-f62e7b41a168	Assigns roles below Owner; grant at RG scope
Virtual Machine Contributor	9980e02c-c2be-4d73-94e8-173b1dc7cf3c	Documented: install/run software, reset root password via extensions
Virtual Machine Administrator Login	1c0163c0-47e6-4577-8991-ea5c82e286e4	Admin login, no VM CRUD
Virtual Machine User Login	fb879df8-f326-4884-b1cf-06f3ad86be52	Regular-user login; day-to-day DBA
Data Operator for Managed Disks	959f8984-c045-4866-89c7-12bf9737be2e	Export disk/SAS while VM stopped
Network Contributor	4d97b98b-1d4f-4787-a291-c67834d212e7	Networks, not VMs
Storage Account Contributor	17d1049b-9a84-46fb-8f53-869881c3d3ab	Lists account keys = full data via Shared Key
Storage Blob Data Reader	2a2b9908-6ea1-4ae2-8e65-a410df84e7d1	Blob contents read via AAD
Storage Blob Data Contributor	ba92f5b4-2d11-453d-a403-e96b0029c9fe	Blob RW, still no keys
Reader and Data Access	c12c1c16-33a1-487b-954d-41c89c60f349	“Read-only” but lists keys → read and write all data
Backup Contributor	5e467623-bb1f-42f4-a55d-6e525e11384b	Manages backup; denials only vault creation + access grants
Backup Operator	00c29273-979b-4161-815c-10b084fb9324	Everything except removal of backup
Backup Reader	a795c7a0-d4a2-40c1-ae25-d81f01202912	Query jobs/instances
Storage Account Backup Contributor	e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1	Backup/restore ops on a storage account
Backup MUA Admin	c2a970b4-16a7-4a51-8c84-8a8ea6ee0bb8	Create/delete Resource Guard
Backup MUA Operator	f54b6d04-23c6-443e-b462-9c16ab7b4a52	Run guard-protected critical ops
Key Vault Administrator	00482a5a-887f-4fb3-b363-3b7fe8e74483	ALL data plane — delete-capable
Key Vault Contributor	f25e0fa2-a7c8-4377-a976-54943a77a395	Vault CRUD, no secret access
Key Vault Secrets User	4633458b-17de-408a-b874-0445c86b69e6	Read secret contents; RBAC-model vaults
Key Vault Reader	21090545-7ca7-4776-b22c-e363652d74d2	Metadata only
Key Vault Data Access Administrator	8b54135c-b56d-4d72-a534-26097cfdc8d8	Delegates data-plane grants, ABAC conditions
Security Reader	39bc4728-0917-49c7-9d2c-d95423bc2eb4	Defender for Cloud, read-only
Security Admin	fb1c8493-542b-48eb-b624-b4c8fea62acd	Updates security policy, dismisses alerts
Monitoring Reader	43d0d8ad-25c7-4714-9337-8ba259a9fe05	Metrics/logs read
Log Analytics Contributor	92aaf0da-9dab-42b6-94a3-d43ce8d16293	Workspace writes incl. VM extension add
Log Analytics Reader	73c42c96-874c-492b-b04d-ab87d138a893	Query workspace
Support Request Contributor	cfd33db0-3dd1-45e3-aa9d-cdbdf3b6f24e	Opens tickets; no infra write
Cost Management Reader	72fafb9e-0641-4937-9268-a91bfd8191a3	Costs/budgets read
Managed Identity Operator	f1a07417-d97a-45cb-824c-7a7467783830	Assign existing UAIs (ACSS deploys [4])
Azure Center for SAP solutions administrator	7b0c7e81-271f-4c71-90bf-e30bdfdbc2f7	Manage VIS resources [4]
Azure Center for SAP solutions reader	05352d14-a920-4328-a0de-4cbe7430e26b	Monitor SAP systems [4]
Azure Center for SAP solutions service role	aabbc5dd-1af0-458b-a942-81af88f9c138	For ACSS’s UAI only — not a human role [4]

Not verified during this pass, so no IDs printed: Resource Group Contributor, ACR data roles. Check inside your tenant: az role definition list --name "<exact role name>" [8].

Granting it: the CLI, straight from the docs

Assigning roles requires Microsoft.Authorization/roleAssignments/write — e.g. Role Based Access Control Administrator, not Owner [8]. Scope formats below are the documented ones [8]:

az role assignment create \
  --assignee "dba-user@contoso.com" \
  --role "Virtual Machine User Login" \
  --scope "/subscriptions/{subId}/resourceGroups/sap-prod-db-rg"

az role assignment create \
  --assignee "grp-sap-basis@contoso.com" \
  --role "Storage Blob Data Reader" \
  --scope "/subscriptions/{subId}/resourceGroups/sap-prod-db-rg/providers/Microsoft.Storage/storageAccounts/saphanabackup01"

# scoped access-granting so Basis never needs Owner/UAA
az role assignment create \
  --assignee "grp-platform-lead@contoso.com" \
  --role "Role Based Access Control Administrator" \
  --scope "/subscriptions/{subId}/resourceGroups/sap-prod-app-rg"

# audit reality check
az role assignment list --scope "/subscriptions/{subId}" --query "[].{p:principalId,r:roleDefinitionId}" -o table

Custom role examples

Microsoft’s recommended method: start from an existing built-in role and subtract [2]. Dump the base role with az role definition list -n "Virtual Machine Contributor" first, then encode exclusions in NotActions.

SAP Basis power-operator. Modelled on the official “Virtual Machine Operator” example [2] — start/action and restart/action are copied from it. powerOff/deallocate and the excluded extensions/runCommand strings follow Microsoft.Compute naming conventions but were not printed in the docs we fetched; verify them against the downloadable permissions CSV [2] before applying, since the exact strings are what make or break the boundary.

{
  "Name": "SAP Basis Power Operator",
  "Description": "Read and power-cycle SAP VMs; no extensions, no runCommand, no network/storage/IAM writes.",
  "Actions": [
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/restart/action",
    "Microsoft.Compute/virtualMachines/powerOff/action",
    "Microsoft.Compute/virtualMachines/deallocate/action",
    "Microsoft.Network/*/read",
    "Microsoft.Storage/*/read",
    "Microsoft.Authorization/*/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.ResourceHealth/availabilityStatuses/read",
    "Microsoft.Insights/alertRules/*",
    "Microsoft.Support/*"
  ],
  "NotActions": [
    "Microsoft.Compute/virtualMachines/extensions/write",
    "Microsoft.Compute/virtualMachines/extensions/delete",
    "Microsoft.Compute/virtualMachines/runCommand/action"
  ],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": ["/subscriptions/{subscriptionId}/resourceGroups/sap-prod-app-rg"]
}

Why the NotActions matter: VM Contributor is documented as able to install and run software and reset the root password through installed extensions [1]. Extension write is root — that line is the entire difference between a Basis operator role and a privilege escalation.

DBA backup-data reader. Data plane, no keys; DataActions/NotDataActions usage mirrors the documented CLI example [9]:

{
  "Name": "SAP DBA Backup Data Reader",
  "Description": "Read backup blobs; cannot write, delete, manage the account, or list keys.",
  "Actions": ["Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/blobServices/containers/read"],
  "NotActions": [],
  "DataActions": ["Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"],
  "NotDataActions": [],
  "AssignableScopes": ["/subscriptions/{subscriptionId}"]
}

az role definition create --role-definition @sap-dba-backup-data-reader.json

PIM: making “eligible, not active” the default

Configure per role and per resource — there is no inheritance to rely on [5]. Standardized settings for SAP tenants (documented behavior per [5]):

PIM setting	Documented behavior	Our SAP baseline
Activation maximum duration	1–24 hours	4 h VM Administrator Login; 8 h Basis power role & Backup Operator
Require MFA on activation	Toggle; may be skipped if strong auth earlier in session	ON for every write-capable role
Require CA authentication context + Authentication Strengths	Conditional Access defines the bar; sign-in frequency “Every time” defeats session reuse; a 10-minute cross-role re-auth window applies	ON, from Intune-compliant jump hosts / Azure Bastion workstations [3]
Require justification	Free-text business justification	ON
Require ticket information	Informational only — no correlation with any ticketing system is enforced	ON for restores & IAM changes; humans verify the ticket
Require approval to activate	Approver needs no Azure role; ≥2 approvers recommended; no default approvers	2 approvers (platform lead + security) for Contributor/Owner-tier and vault data grants
Assignment duration	Per assignment type: allow permanent eligible/active, or force expiry; self-service extend/renew exists	Eligible expires ≤365 d; no permanent active write assignments
MFA on active assignment	PIM cannot force MFA when the user uses an already-active assignment	The core reason active write assignments are banned
Notifications	Granular per email type; max 1,000 recipients per event	Approver = monitored distribution group

This operationalizes the CAF guidance: privileged roles active only when needed, e.g. to start or stop a VM, with request/approval and full audit [6].

“Owner is easier” — the real blast radius

Each row is grounded in a documented capability, not folklore:

Owner/Contributor effectively grants	Documented mechanism	SAP-world outcome
Root on every SAP server	VM Contributor can install/run software and reset root password via extensions [1]	Read SAP master password file and HANA keys on disk
Full read and write of all backup data	Storage Account Contributor and Reader-and-Data-Access can list storage account keys [1]; Shared Key bypasses your AAD data-plane RBAC	A “read-only support” role exfiltrates the entire HANA backup store
Deleting backup history	Backup Contributor’s only denials are vault creation and access grants; Backup Operator is the one explicitly denied removal of backup [1]	Ransomware step 2: delete backups before encrypting. Microsoft’s SAP ransomware guidance wants SAP/server admins at read-only to the vault [3]
Self-granting anything	Owner includes role-assignment writes; UAA mints permissions [1][8]	One phished account compromises the tenant — and Owner can rewrite the PIM role settings that gate it [5]
Cost & quota abuse	Contributor can deploy any SKU, start deallocated VMs	Dev box runs M-series fleet overnight; Cost Management Reader gives visibility without write [1]
Hiding evidence	Security Admin can update security policy and dismiss alerts [1]	Defender for Cloud alerts silently vanish
Unrecoverable data	Key Vault Administrator covers all data-plane ops including deletion [1]	CMK vault purged; encrypted SAP data is gone

ACSS shrinks two of these: deploy and operate SAP systems with its admin/reader/service roles plus Managed Identity Operator instead of raw Contributor [4] — though note the documented wart that standing up Azure Monitor for SAP currently requires Contributor [4]; time-box that grant via PIM. Per the baseline, the vault should also sit behind multi-user authorization with the Resource Guard roles, so even Backup Contributor cannot delete a backup alone [3][7].

FAQ

Why not just use ABAC instead of custom roles?

ABAC conditions narrow a role assignment; custom roles reshape the permission itself — the two compose (Key Vault Data Access Administrator even ships with its own grant condition [1]). Rule of thumb: ABAC for “only my department’s resource groups”, custom roles to cut an action such as extension write out of a built-in package. ABAC prerequisites are tenant configuration you must enable — exact condition availability in your tenant is 需订阅内验证.

“Reader and Data Access” sounds read-only. Safe for DBAs?

No. The published description states it can list storage account keys, and key holders can read and write all data via Shared Key [1]. Use Storage Blob Data Reader or a DataActions custom role — AAD-based, logged, revocable per user.

Can we skip PIM for the audit team?

Yes — and you should not PIM-gate audit. Reader, Security Reader, Backup Reader and Key Vault Reader are read-only control-plane roles; permanent active assignment keeps auditors independent of the people they audit [1][5]. The one exception: anything that reads secret values, where the auditor gets metadata-only Key Vault Reader instead.

Basis says it needs extension write for patching. Now what?

Keep extension write in a separate, PIM-gated platform-team role; patch agents install extensions under that grant during a change window while Basis keeps the power-operator role. If one approved extension must be pushed ad hoc, assign Contributor at the single VM’s resource scope for the window — resource-scope assignment is fully documented [8].

How do we prove the matrix is enforced?

Continuous export — az role assignment list per scope (or Resource Graph) diffed against the intended-state table, feeding Sentinel; the SAP security baseline explicitly recommends Sentinel-for-SAP/SIEM monitoring [3][6]. Off-matrix assignments become alerts, not quarterly-spreadsheet discoveries. Note the custom-role cap if you mint many variants: 5,000 per Entra tenant (2,000 for Azure operated by 21Vianet) [2].

Sources

All accessed 2026-11-08. Numbering matches in-text citations.

1. Azure built-in roles — Microsoft Learn, doc dated 2026-09-10. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles — IDs verified from raw mirror https://raw.githubusercontent.com/MicrosoftDocs/azure-docs/main/articles/role-based-access-control/built-in-roles.md
2. Azure custom roles — Microsoft Learn, last updated 2025-10-23. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles
3. Secure Azure infrastructure for SAP workloads — Microsoft Learn, last updated 2026-07-22. https://learn.microsoft.com/en-us/azure/sap/workloads/sap-security-infrastructure
4. Manage Azure Center for SAP solutions with Azure RBAC — Microsoft Learn, last updated 2026-04-08. https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/manage-with-azure-rbac
5. Configure Azure resource role settings in PIM — Microsoft Entra, ms.date 2026-04-23. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-resource-roles-configure-role-settings
6. Security operations for SAP in the Azure landing zone — Cloud Adoption Framework, ms.date 2023-07-18. https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/sap/sap-lza-security-operations
7. Multi-user authorization for Azure Backup — linked from [3]; not independently re-verified this pass (需订阅内验证 for the guard workflow). https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization
8. Assign Azure roles using Azure CLI — Microsoft Learn. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-cli
9. az role definition — Azure CLI reference. https://learn.microsoft.com/en-us/cli/azure/role/definition
10. No vendor publishes a normative four-team SAP RBAC matrix; the combinations here are our engineering guidance derived from [1]–[6], and permission outcomes in your landscape remain 需订阅内验证.