{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/", "slug": "dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource", "url": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/" }, "title": "Grant service-catalog definition access separately from managed-resource administration", "summary": "Which permission lets intended consumers read a managed-application definition without confusing it with publisher administration?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:50+00:00", "modified_at": "2026-09-10T00:52:38+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 250, "potentially_affected": "Organizations publishing Azure Managed Applications through the service catalog.", "dse_recommendation": "DSE recommends checking catalog-definition read access using the intended consumer identity before changing publisher authorizations.", "primary_source": { "name": "Create and publish Azure Managed Application in service catalog - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-service-catalog-app", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft directs publishers to give intended users at least Reader access to a service-catalog managed-application definition, noting that subscription or resource-group inheritance may already provide it. The definition’s authorization configuration serves a different purpose: it identifies the principal and role used for permissions on the managed resource group. Reading the catalog definition and administering deployed resources are separate access checks. Microsoft Learn.

\n

Applicability

\n

Use this distinction when a published definition is available to its creator but not to an intended consumer. Keep the investigation focused on that definition and the consumer’s effective read access. Do not treat a successful publisher session as evidence that another user can read it.

\n

DSE recommendation

\n

DSE recommends checking catalog-definition read access using the intended consumer identity before changing publisher authorizations. Inspect inherited access first, then propose the narrowest appropriate assignment if a genuine gap remains. Record catalog access and managed-resource administration as separate decisions. Do not add the consumer to a privileged publisher group simply to address definition visibility, or assume that Reader access proves every permission needed for a later deployment.

\n

Verification

\n

Use an authorized representative account to open the exact definition and confirm that its expected contents are available. Record the identity, definition ID and access path that produced that result. Review the managed-resource authorization entries independently against the approved maintainer list. Close the visibility issue only after testing the consumer’s experience, while preserving a separate review for deployment and ongoing resource-management permissions.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nMicrosoft directs publishers to give intended users at least Reader access to a service-catalog managed-application definition, noting that subscription or resource-group inheritance may already provide it. The definition’s authorization configuration serves a different purpose: it identifies the principal and role used for permissions on the managed resource group. Reading the catalog definition and administering deployed resources are separate access checks. Microsoft Learn.\nApplicability\nUse this distinction when a published definition is available to its creator but not to an intended consumer. Keep the investigation focused on that definition and the consumer’s effective read access. Do not treat a successful publisher session as evidence that another user can read it.\nDSE recommendation\nDSE recommends checking catalog-definition read access using the intended consumer identity before changing publisher authorizations. Inspect inherited access first, then propose the narrowest appropriate assignment if a genuine gap remains. Record catalog access and managed-resource administration as separate decisions. Do not add the consumer to a privileged publisher group simply to address definition visibility, or assume that Reader access proves every permission needed for a later deployment.\nVerification\nUse an authorized representative account to open the exact definition and confirm that its expected contents are available. Record the identity, definition ID and access path that produced that result. Review the managed-resource authorization entries independently against the approved maintainer list. Close the visibility issue only after testing the consumer’s experience, while preserving a separate review for deployment and ongoing resource-management permissions.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nMicrosoft directs publishers to give intended users at least Reader access to a service-catalog managed-application definition, noting that subscription or resource-group inheritance may already provide it. The definition’s authorization configuration serves a different purpose: it identifies the principal and role used for permissions on the managed resource group. Reading the catalog definition and administering deployed resources are separate access checks. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-service-catalog-app).\n\n## Applicability\n\nUse this distinction when a published definition is available to its creator but not to an intended consumer. Keep the investigation focused on that definition and the consumer’s effective read access. Do not treat a successful publisher session as evidence that another user can read it.\n\n## DSE recommendation\n\nDSE recommends checking catalog-definition read access using the intended consumer identity before changing publisher authorizations. Inspect inherited access first, then propose the narrowest appropriate assignment if a genuine gap remains. Record catalog access and managed-resource administration as separate decisions. Do not add the consumer to a privileged publisher group simply to address definition visibility, or assume that Reader access proves every permission needed for a later deployment.\n\n## Verification\n\nUse an authorized representative account to open the exact definition and confirm that its expected contents are available. Record the identity, definition ID and access path that produced that result. Review the managed-resource authorization entries independently against the approved maintainer list. Close the visibility issue only after testing the consumer’s experience, while preserving a separate review for deployment and ongoing resource-management permissions.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-service-catalog-app). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/", "url": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Grant service-catalog definition access separately from managed-resource administration", "item": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/", "url": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/", "headline": "Grant service-catalog definition access separately from managed-resource administration", "description": "Which permission lets intended consumers read a managed-application definition without confusing it with publisher administration?", "abstract": "Which permission lets intended consumers read a managed-application definition without confusing it with publisher administration?", "articleBody": "Source facts\nMicrosoft directs publishers to give intended users at least Reader access to a service-catalog managed-application definition, noting that subscription or resource-group inheritance may already provide it. The definition’s authorization configuration serves a different purpose: it identifies the principal and role used for permissions on the managed resource group. Reading the catalog definition and administering deployed resources are separate access checks. Microsoft Learn.\nApplicability\nUse this distinction when a published definition is available to its creator but not to an intended consumer. Keep the investigation focused on that definition and the consumer’s effective read access. Do not treat a successful publisher session as evidence that another user can read it.\nDSE recommendation\nDSE recommends checking catalog-definition read access using the intended consumer identity before changing publisher authorizations. Inspect inherited access first, then propose the narrowest appropriate assignment if a genuine gap remains. Record catalog access and managed-resource administration as separate decisions. Do not add the consumer to a privileged publisher group simply to address definition visibility, or assume that Reader access proves every permission needed for a later deployment.\nVerification\nUse an authorized representative account to open the exact definition and confirm that its expected contents are available. Record the identity, definition ID and access path that produced that result. Review the managed-resource authorization entries independently against the approved maintainer list. Close the visibility issue only after testing the consumer’s experience, while preserving a separate review for deployment and ongoing resource-management permissions.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:50+00:00", "dateModified": "2026-09-10T00:52:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-126-grant-service-catalog-definition-access-separately-from-managed-resource/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Grant service-catalog definition access separately from managed-resource administration" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 250, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create and publish Azure Managed Application in service catalog - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-service-catalog-app" } } ] } }