// roles/azure · migration

Azure Local Migrate Execute ExpertAzure built-in role

Grants restricted access on an Azure Local based Azure Migrate project to only perform migration related operations, including replication, execution of migrations, tracking and monitoring of migration progress, and initiation of agentless migrations.

Role ID	`1cfa4eac-9a23-481c-a793-bfb6958e836c`
Category	Migration
Actions	40 (minus 6 NotActions)
Data actions	0

Before you assign it

It can give access to others. It allows Microsoft.Authorization/roleAssignments/write, so treat it as a privileged role and assign it through PIM where you can.

What it can do

Permission	What it allows
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/write`	Creates or updates a resource group.
`Microsoft.Resources/subscriptions/locations/read`	Gets the list of locations supported.
`Microsoft.Resources/checkResourceName/action`	Check the resource name for validity.
`Microsoft.Resources/deployments/validate/action`	Validates a deployment.
`Microsoft.Resources/deploymentScripts/write`	Creates or updates a deployment script
`Microsoft.Resources/deploymentScripts/read`	Gets or lists deployment scripts
`Microsoft.Resources/links/write`	Creates or updates a resource link.
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Authorization/locks/write`	Add locks at the specified scope.
`Microsoft.Authorization/locks/delete`	Delete locks at the specified scope.
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Migrate/*/read`	Any read operation on anything under Microsoft.Migrate
`Microsoft.ApplicationMigration/*/read`	Any read operation on anything under Microsoft.ApplicationMigration
`Microsoft.OffAzure/*/read`	Any read operation on anything under Microsoft.OffAzure
`Microsoft.MySQLDiscovery/*/read`	Any read operation on anything under Microsoft.MySQLDiscovery
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.Storage/storageAccounts/*/read`	Any read operation on anything under Microsoft.Storage/storageAccounts
`Microsoft.Storage/storageAccounts/*/write`	Any write operation on anything under Microsoft.Storage/storageAccounts
`Microsoft.Storage/storageAccounts/listKeys/action`	Returns the access keys for the specified storage account.
`Microsoft.Resources/links/read`	Gets or lists resource links.
`Microsoft.DependencyMap/*/read`	Any read operation on anything under Microsoft.DependencyMap
`Microsoft.DependencyMap/maps/*/action`	Any action on anything under Microsoft.DependencyMap/maps
`Microsoft.AzureStackHCI/*/Read`	Any read operation on anything under Microsoft.AzureStackHCI
`Microsoft.AzureStackHCI/LogicalNetworks/join/action`	Joins logical networks resource
`Microsoft.AzureStackHCI/NetworkInterfaces/*`	Every operation under Microsoft.AzureStackHCI/NetworkInterfaces
`Microsoft.AzureStackHCI/VirtualHardDisks/*`	Every operation under Microsoft.AzureStackHCI/VirtualHardDisks
`Microsoft.AzureStackHCI/VirtualMachines/Write`	Creates/Updates virtual machine resource
`Microsoft.AzureStackHCI/VirtualMachineInstances/Write`	Creates/Updates virtual machine instance resource
`Microsoft.DataReplication/*/read`	Any read operation on anything under Microsoft.DataReplication
`Microsoft.DataReplication/replicationVaults/protectedItems/*`	Every operation under Microsoft.DataReplication/replicationVaults/protectedItems
`Microsoft.DataReplication/replicationVaults/replicationExtensions/*`	Every operation under Microsoft.DataReplication/replicationVaults/replicationExtensions
`Microsoft.DataReplication/replicationVaults/replicationPolicies/*`	Every operation under Microsoft.DataReplication/replicationVaults/replicationPolicies
`Microsoft.ExtendedLocation/customLocations/read`	Gets an Custom Location resource
`Microsoft.KubernetesConfiguration/extensions/read`	Gets extension instance resource.
`Microsoft.ResourceConnector/appliances/read`	Gets an Appliance resource
`Microsoft.Authorization/roleAssignments/write`	Create a role assignment at the specified scope.
`Microsoft.Authorization/roleAssignments/delete`	Delete a role assignment at the specified scope.

Can't do

These are taken away from the actions above.

Permission	What it allows
`Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*`	Every operation under Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates
`Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*`	Every operation under Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities
`Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*`	Every operation under Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates
`Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*`	Every operation under Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities
`Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*`	Every operation under Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities
`Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*`	Every operation under Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Local Migrate Execute Expert" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Local Migrate Execute Expert" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '1cfa4eac-9a23-481c-a793-bfb6958e836c')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1cfa4eac-9a23-481c-a793-bfb6958e836c')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "1cfa4eac-9a23-481c-a793-bfb6958e836c"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other migration roles

Migrate Arc Discovery Reader - Preview · 8 permissions
Azure Migrate Service Reader · 11 permissions
Azure Migrate Execute Expert · 45 permissions
Azure Migrate Decide and Plan Expert · 51 permissions
Azure Local Migrate Owner · 64 permissions
Azure Migrate Owner · 68 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles