// roles/azure · management-and-governance

Azure Connected Machine Resource ManagerAzure built-in role

Custom Role for AzureStackHCI RP to manage hybrid compute machines and hybrid connectivity endpoints in a resource group

Role ID	`f5819b54-e033-4d82-ac66-4fec3cbf3f4c`
Category	Management-and-governance
Actions	34
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.GuestConfiguration/guestConfigurationAssignments/*/read`	Any read operation on anything under Microsoft.GuestConfiguration/guestConfigurationAssignments
`Microsoft.GuestConfiguration/guestConfigurationAssignments/read`	Get guest configuration assignment.
`Microsoft.GuestConfiguration/guestConfigurationAssignments/write`	Create new guest configuration assignment.
`Microsoft.HybridCompute/machines/read`	Read any Azure Arc machines
`Microsoft.HybridCompute/machines/extensions/read`	Reads any Azure Arc extensions
`Microsoft.HybridCompute/*/read`	Any read operation on anything under Microsoft.HybridCompute
`Microsoft.HybridCompute/machines/delete`	Deletes an Azure Arc machines
`Microsoft.HybridCompute/machines/extensions/delete`	Deletes an Azure Arc extensions
`Microsoft.HybridCompute/machines/extensions/write`	Installs or Updates an Azure Arc extensions
`Microsoft.HybridCompute/machines/licenseProfiles/delete`	Deletes an Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/licenseProfiles/read`	Reads any Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/licenseProfiles/write`	Installs or Updates an Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/UpgradeExtensions/action`	Upgrades Extensions on Azure Arc machines
`Microsoft.HybridCompute/machines/write`	Writes an Azure Arc machines
`Microsoft.HybridConnectivity/endpoints/read`	List of endpoints to the target resource.
`Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read`	API to enumerate registered services in service configurations under a Endpoint Resource
`Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write`	Create or update a service in serviceConfiguration for the endpoint resource.
`Microsoft.HybridConnectivity/endpoints/write`	Create or update the endpoint to the target resource.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.EdgeMarketplace/locations/operationStatuses/read`	read operationStatuses
`Microsoft.EdgeMarketPlace/offers/getAccessToken/action`	A long-running resource action.
`Microsoft.EdgeMarketPlace/offers/generateAccessToken/action`	A long-running resource action.
`Microsoft.EdgeMarketplace/publishers/read`	List Publisher resources by subscription ID
`Microsoft.EdgeMarketplace/offers/read`	List Offer resources by subscription ID
`Microsoft.ExtendedLocation/customLocations/read`	Gets an Custom Location resource
`Microsoft.Attestation/attestationProviders/write`	Adds attestation service.
`Microsoft.Attestation/attestationProviders/read`	Gets the attestation service status.
`Microsoft.Attestation/attestationProviders/delete`	Removes attestation service.
`Microsoft.Attestation/attestationProviders/attestation/read`	Gets the attestation service status.
`Microsoft.Attestation/attestationProviders/attestation/write`	Adds attestation service.
`Microsoft.Attestation/attestationProviders/attestation/delete`	Removes attestation service.
`Microsoft.HybridCompute/settings/read`	Reads any Azure Arc settings
`Microsoft.HybridCompute/settings/write`	Writes an Azure Arc settings

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Connected Machine Resource Manager" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Connected Machine Resource Manager" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'f5819b54-e033-4d82-ac66-4fec3cbf3f4c')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f5819b54-e033-4d82-ac66-4fec3cbf3f4c')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "f5819b54-e033-4d82-ac66-4fec3cbf3f4c"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Service Group Contributor · 1 permission
Template Spec Reader · 1 permission
Carbon Optimization Reader · 2 permissions
Hierarchy Settings Administrator · 2 permissions
Reservations Reader · 2 permissions
Service Group Reader · 2 permissions
Advisor Reviews Reader · 3 permissions
Managed Application Operator Role · 3 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles