azureblog.co.uk
← cd ~/compare
// compare · azure roles

Virtual Machine Contributor vs Virtual Machine Administrator Login

Two Azure built-in roles that are often confused, compared permission by permission.

In short: Virtual Machine Contributor has 45 actions. Virtual Machine Administrator Login has 7 actions, 4 data actions. Assign the one with less access that still covers the job.

Virtual Machine ContributorVirtual Machine Administrator Login
What Microsoft saysLets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected to.View Virtual Machines in the portal and login as administrator
Size45 actions7 actions, 4 data actions

Permissions only Virtual Machine Contributor lists (42)

  • Microsoft.Authorization/*/read
  • Microsoft.Compute/availabilitySets/*
  • Microsoft.Compute/locations/*
  • Microsoft.Compute/virtualMachines/*
  • Microsoft.Compute/virtualMachineScaleSets/*
  • Microsoft.Compute/cloudServices/*
  • Microsoft.Compute/disks/write
  • Microsoft.Compute/disks/read
  • Microsoft.Compute/disks/delete
  • Microsoft.Compute/hostgroups/write
  • Microsoft.Compute/hostgroups/hosts/write
  • Microsoft.DevTestLab/schedules/*
  • Microsoft.Insights/alertRules/*
  • Microsoft.Network/applicationGateways/backendAddressPools/join/action
  • Microsoft.Network/loadBalancers/backendAddressPools/join/action
  • Microsoft.Network/loadBalancers/inboundNatPools/join/action
  • Microsoft.Network/loadBalancers/inboundNatRules/join/action
  • Microsoft.Network/loadBalancers/probes/join/action
  • Microsoft.Network/locations/*
  • Microsoft.Network/networkInterfaces/*
  • Microsoft.Network/networkSecurityGroups/join/action
  • Microsoft.Network/networkSecurityGroups/read
  • Microsoft.Network/publicIPAddresses/join/action
  • Microsoft.Network/virtualNetworks/subnets/join/action
  • Microsoft.RecoveryServices/locations/*
  • Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write
  • Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/*/read
  • Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read
  • Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write
  • Microsoft.RecoveryServices/Vaults/backupPolicies/read
  • Microsoft.RecoveryServices/Vaults/backupPolicies/write
  • Microsoft.RecoveryServices/Vaults/read
  • Microsoft.RecoveryServices/Vaults/usages/read
  • Microsoft.RecoveryServices/Vaults/write
  • Microsoft.ResourceHealth/availabilityStatuses/read
  • Microsoft.Resources/deployments/*
  • Microsoft.Resources/subscriptions/resourceGroups/read
  • Microsoft.SerialConsole/serialPorts/connect/action
  • Microsoft.SqlVirtualMachine/*
  • Microsoft.Storage/storageAccounts/listKeys/action

…and 2 more.

Permissions only Virtual Machine Administrator Login lists (4)

  • Microsoft.Network/networkInterfaces/read
  • Microsoft.Compute/virtualMachines/*/read
  • Microsoft.HybridCompute/machines/*/read
  • Microsoft.HybridConnectivity/endpoints/listCredentials/action

Azure roles use wildcards such as *, and NotActions take permissions away, so a role can cover an action without listing it. Check the role pages for the full picture.

Virtual Machine Contributor explained Virtual Machine Administrator Login explained

Sources