// roles/azure · compute

Azure Arc VMware VM ContributorAzure built-in role

Arc VMware VM Contributor has permissions to perform all VM actions.

Role ID	`b748a06d-6150-4f8a-aaa9-ce3940cd96cb`
Category	Compute
Actions	56
Data actions	0

What it can do

Permission	What it allows
`Microsoft.ConnectedVMwarevSphere/virtualmachines/*`	Every operation under Microsoft.ConnectedVMwarevSphere/virtualmachines
`Microsoft.ConnectedVMwarevSphere/virtualmachineinstances/*`	Every operation under Microsoft.ConnectedVMwarevSphere/virtualmachineinstances
`Microsoft.Insights/AlertRules/Write`	Create or update a classic metric alert
`Microsoft.Insights/AlertRules/Delete`	Delete a classic metric alert
`Microsoft.Insights/AlertRules/Read`	Read a classic metric alert
`Microsoft.Insights/AlertRules/Activated/Action`	Classic metric alert activated
`Microsoft.Insights/AlertRules/Resolved/Action`	Classic metric alert resolved
`Microsoft.Insights/AlertRules/Throttled/Action`	Classic metric alert rule throttled
`Microsoft.Insights/AlertRules/Incidents/Read`	Read a classic metric alert incident
`Microsoft.Resources/deployments/read`	Gets or lists deployments.
`Microsoft.Resources/deployments/write`	Creates or updates an deployment.
`Microsoft.Resources/deployments/delete`	Deletes a deployment.
`Microsoft.Resources/deployments/cancel/action`	Cancels a deployment.
`Microsoft.Resources/deployments/validate/action`	Validates a deployment.
`Microsoft.Resources/deployments/whatIf/action`	Predicts template deployment changes.
`Microsoft.Resources/deployments/exportTemplate/action`	Export template for a deployment
`Microsoft.Resources/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/deployments/operationstatuses/read`	Gets or lists deployment operation statuses.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/read`	Gets or lists deployments.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/write`	Creates or updates an deployment.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read`	Gets or lists deployment operation statuses.
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/subscriptions/operationresults/read`	Get the subscription operation results.
`Microsoft.HybridCompute/machines/read`	Read any Azure Arc machines
`Microsoft.HybridCompute/machines/write`	Writes an Azure Arc machines
`Microsoft.HybridCompute/machines/delete`	Deletes an Azure Arc machines
`Microsoft.HybridCompute/machines/UpgradeExtensions/action`	Upgrades Extensions on Azure Arc machines
`Microsoft.HybridCompute/machines/assessPatches/action`	Assesses any Azure Arc machines to get missing software patches
`Microsoft.HybridCompute/machines/installPatches/action`	Installs patches on any Azure Arc machines
`Microsoft.HybridCompute/machines/extensions/read`	Reads any Azure Arc extensions
`Microsoft.HybridCompute/machines/extensions/write`	Installs or Updates an Azure Arc extensions
`Microsoft.HybridCompute/machines/extensions/delete`	Deletes an Azure Arc extensions
`Microsoft.HybridCompute/operations/read`	Read all Operations for Azure Arc for Servers
`Microsoft.HybridCompute/locations/operationresults/read`	Reads the status of an operation on Microsoft.HybridCompute Resource Provider
`Microsoft.HybridCompute/locations/operationstatus/read`	Reads the status of an operation on Microsoft.HybridCompute Resource Provider
`Microsoft.HybridCompute/machines/patchAssessmentResults/read`	Reads any Azure Arc patchAssessmentResults
`Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read`	Reads any Azure Arc patchAssessmentResults/softwarePatches
`Microsoft.HybridCompute/machines/patchInstallationResults/read`	Reads any Azure Arc patchInstallationResults
`Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read`	Reads any Azure Arc patchInstallationResults/softwarePatches
`Microsoft.HybridCompute/locations/updateCenterOperationResults/read`	Reads the status of an update center operation on machines
`Microsoft.HybridCompute/machines/hybridIdentityMetadata/read`	Read any Azure Arc machines's Hybrid Identity Metadata
`Microsoft.HybridCompute/osType/agentVersions/read`	Read all Azure Connected Machine Agent versions available
`Microsoft.HybridCompute/osType/agentVersions/latest/read`	Read the latest Azure Connected Machine Agent version
`Microsoft.HybridCompute/machines/runcommands/read`	Reads any Azure Arc runcommands
`Microsoft.HybridCompute/machines/runcommands/write`	Installs or Updates an Azure Arc runcommands
`Microsoft.HybridCompute/machines/runcommands/delete`	Deletes an Azure Arc runcommands
`Microsoft.HybridCompute/machines/licenseProfiles/read`	Reads any Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/licenseProfiles/write`	Installs or Updates an Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/licenseProfiles/delete`	Deletes an Azure Arc licenseProfiles
`Microsoft.HybridCompute/licenses/read`	Reads any Azure Arc licenses
`Microsoft.HybridCompute/licenses/write`	Installs or Updates an Azure Arc licenses
`Microsoft.HybridCompute/licenses/delete`	Deletes an Azure Arc licenses

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Arc VMware VM Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Arc VMware VM Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'b748a06d-6150-4f8a-aaa9-ce3940cd96cb')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b748a06d-6150-4f8a-aaa9-ce3940cd96cb')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "b748a06d-6150-4f8a-aaa9-ce3940cd96cb"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other compute roles

Compute Gallery Sharing Admin · 1 permission
Compute Gallery Image Reader · 2 permissions
Desktop Virtualization User · 2 permissions
Virtual Machine Local User Login · 2 permissions
Azure Batch Account Reader · 3 permissions
Disk Backup Reader · 3 permissions
Data Operator for Managed Disks · 4 permissions
Windows 365 Network User · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles