# IT:AD:Azure:Security:Role:Administration:Service Administrator (SA) #

<callout type="Navigation" class="small">

* [[../|(UP)]]
{{indexmenu>.#2|nsort tsort}}
* See also:
  * [[IT/AD/Azure/Security/Role/Administration/]]
  * [[IT/AD/Azure/Security/Role/Administration/Account Administrator/]]
  * [[IT/AD/Azure/Security/Role/Administration /Service Co-Administrator/]]
  * [[IT/AD/Azure/Subscription/]]


</callout>


<panel title="Summary">

One of the 3 [[IT/AD/Azure/Security/Role/Administration/|Administration Roles]] ((https://azure.microsoft.com/en-us/documentation/articles/billing-add-change-azure-subscription-administrator/)).

When a [[IT/AD/Azure/Subscription/|Subscription]] is created, the same [[IT/AD/Azure/Account/|Account]] used for the [[IT/AD/Azure/Security/Role/Administration/Account Administrator/|Account Administrator (AA)]] is used to set up the [[IT/AD/Azure/Subscription/|Subscription]]'s [[IT/AD/Azure/Security/Role/Administration/Service Administrator/|Service Administrator (SA)]].


</panel>


## Notes ##

There is only one [[IT/AD/Azure/Security/Role/Administration/Service Administrator/|Service Administrator (SA)]].

Can do all that an [[IT/AD/Azure/Security/Role/Administration/Account Administrator/|Account Administrator (AA)]] can -- bar see the billing information.

Can in turn set up to 200 [[IT/AD/Azure/Security/Role/Administration/Service Co-Administrator/|Service Co-Administrators (CAs)]].

[[IT/AD/Azure/Security/Role/Administration/Service Co-Administrator/|Service Co-Administrator (CAs)]]s have the same permissions as the [[IT/AD/Azure/Security/Role/Administration/Service Administrator/|Service Administrator (SA)]] (ie, can create Services) -- bar adding/removing [[IT/AD/Azure/Security/Role/Administration/Service Co-Administrator/|Service Co-Administrators (CAs)]].

<callout icon="true" type="tip">
The reason for the split between [[IT/AD/Azure/Security/Role/Administration/Service Administrator/|Service Administrator (SA)]] and [[IT/AD/Azure/Security/Role/Administration/Service Co-Administrator/|Service Co-Administrators (CAs)]] is an artificial way of defining which Admin can revoke service creation rights from others -- and not have it done to him/her...
</callout>

<uml>

!includeurl http://skysigal.com/_media/resources/configuration/plantuml/default.txt
skinparam packageStyle rect
hide circles

class Subscription {
  Account Administrator : Account
  Service Administrator : Account
  Co-administrators : Account[]
}
class Account

Subscription o-- "1-*" Account

</uml>



### Relationship to Azure AD Roles

Remembering that <span important>the Azure AD Service is not the same Service as AD itself</span> is...not obvious.

Whereas the the creator of an Azure AD (which is generally the [[IT/AD/Azure/Security/Role/Administration/Account Administrator/]]) is automatically made a [[IT/AD/Azure AD/Roles/Administration/|Azure AD Global Administrator]], others won't be -- unless manually added and provisioned with an Azure AD administration role (they <span important>won't even see an AD to manage in their Portal</span>)((http://www.edutech.me.uk/microsoft/identity-and-access-management/active-directory/microsoft-azure-how-subscription-administrators-directory-administrators-differ/)).




## Resources ##