Grant service-catalog definition access separately from managed-resource administration

Source facts

Microsoft directs publishers to give intended users at least Reader access to a service-catalog managed-application definition, noting that subscription or resource-group inheritance may already provide it. The definition’s authorization configuration serves a different purpose: it identifies the principal and role used for permissions on the managed resource group. Reading the catalog definition and administering deployed resources are separate access checks. Microsoft Learn.

Applicability

Use this distinction when a published definition is available to its creator but not to an intended consumer. Keep the investigation focused on that definition and the consumer’s effective read access. Do not treat a successful publisher session as evidence that another user can read it.

DSE recommendation

DSE recommends checking catalog-definition read access using the intended consumer identity before changing publisher authorizations. Inspect inherited access first, then propose the narrowest appropriate assignment if a genuine gap remains. Record catalog access and managed-resource administration as separate decisions. Do not add the consumer to a privileged publisher group simply to address definition visibility, or assume that Reader access proves every permission needed for a later deployment.

Verification

Use an authorized representative account to open the exact definition and confirm that its expected contents are available. Record the identity, definition ID and access path that produced that result. Review the managed-resource authorization entries independently against the approved maintainer list. Close the visibility issue only after testing the consumer’s experience, while preserving a separate review for deployment and ongoing resource-management permissions.

Official references

Microsoft Learn. Source retrieved September 9, 2026.