// roles/azure · migration

Azure Local Migrate OwnerAzure built-in role

Grants full access to create and manage Azure Local based Azure Migrate projects including appliance-based discovery and execution of migrations; Also grants ability to assign Azure Migrate Local specific roles in Azure RBAC

Role ID	`fd8ea4d5-6509-4db0-bada-356ab233b4fb`
Category	Migration
Actions	64
Data actions	0

Before you assign it

It can give access to others. It allows Microsoft.Authorization/roleAssignments/write, so treat it as a privileged role and assign it through PIM where you can.

What it can do

Permission	What it allows
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/write`	Creates or updates a resource group.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/locations/read`	Gets the list of locations supported.
`Microsoft.Resources/checkResourceName/action`	Check the resource name for validity.
`Microsoft.Resources/deployments/validate/action`	Validates a deployment.
`Microsoft.Resources/deploymentScripts/write`	Creates or updates a deployment script
`Microsoft.Resources/deploymentScripts/read`	Gets or lists deployment scripts
`Microsoft.Resources/links/write`	Creates or updates a resource link.
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Authorization/locks/write`	Add locks at the specified scope.
`Microsoft.Authorization/locks/delete`	Delete locks at the specified scope.
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Migrate/*`	Every operation under Microsoft.Migrate
`Microsoft.ApplicationMigration/*`	Every operation under Microsoft.ApplicationMigration
`Microsoft.OffAzure/*`	Every operation under Microsoft.OffAzure
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.MySQLDiscovery/*`	Every operation under Microsoft.MySQLDiscovery
`Microsoft.DependencyMap/*`	Every operation under Microsoft.DependencyMap
`Microsoft.KeyVault/vaults/*`	Every operation under Microsoft.KeyVault/vaults
`Microsoft.KeyVault/checkNameAvailability/read`	Checks that a key vault name is valid and is not in use
`Microsoft.HybridCompute/machines/read`	Read any Azure Arc machines
`Microsoft.HybridCompute/machines/write`	Writes an Azure Arc machines
`Microsoft.HybridCompute/machines/delete`	Deletes an Azure Arc machines
`Microsoft.HybridCompute/register/action`	Registers the subscription for the Microsoft.HybridCompute Resource Provider
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/virtualNetworks/subnets/write`	Creates a virtual network subnet or updates an existing virtual network subnet
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/privateEndpoints/read`	Gets an private endpoint resource.
`Microsoft.Network/privateEndpoints/write`	Creates a new private endpoint, or updates an existing private endpoint.
`Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write`	Puts a Private DNS Zone Group
`Microsoft.Network/privateDnsZones/write`	Create or update a Private DNS zone within a resource group. Note that this command cannot be used to create or update virtual network links or record sets within the zone.
`Microsoft.Network/privateDnsZones/virtualNetworkLinks/write`	Create or update a Private DNS zone link to virtual network.
`Microsoft.Network/privateDnsZones/join/action`	Joins a Private DNS Zone
`Microsoft.Network/privateDnsZones/A/write`	Create or update a record set of type 'A' within a Private DNS zone. The records specified will replace the current records in the record set.
`Microsoft.Network/register/action`	Registers the subscription
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read`	Gets a Private DNS Zone Group
`Microsoft.Storage/storageAccounts/*`	Every operation under Microsoft.Storage/storageAccounts
`Microsoft.GuestConfiguration/register/action`	Registers the subscription for the Microsoft.GuestConfiguration resource provider.
`Microsoft.HybridConnectivity/register/action`	Register the subscription for Microsoft.HybridConnectivity
`Microsoft.RecoveryServices/vaults/*`	Every operation under Microsoft.RecoveryServices/vaults
`Microsoft.RecoveryServices/register/action`	Registers subscription for given Resource Provider
`Microsoft.RecoveryServices/operations/read`	Operation returns the list of Operations for a Resource Provider
`Microsoft.DataReplication/*/read`	Any read operation on anything under Microsoft.DataReplication
`Microsoft.DataReplication/register/action`
`Microsoft.DataReplication/replicationFabrics/*`	Every operation under Microsoft.DataReplication/replicationFabrics
`Microsoft.DataReplication/replicationVaults/*`	Every operation under Microsoft.DataReplication/replicationVaults
`Microsoft.KeyVault/register/action`	Registers a subscription
`Microsoft.AzureArcData/register/action`
`Microsoft.Resources/links/read`	Gets or lists resource links.
`Microsoft.AzureStackHCI/*/Read`	Any read operation on anything under Microsoft.AzureStackHCI
`Microsoft.AzureStackHCI/LogicalNetworks/join/action`	Joins logical networks resource
`Microsoft.AzureStackHCI/NetworkInterfaces/*`	Every operation under Microsoft.AzureStackHCI/NetworkInterfaces
`Microsoft.AzureStackHCI/VirtualHardDisks/*`	Every operation under Microsoft.AzureStackHCI/VirtualHardDisks
`Microsoft.AzureStackHCI/VirtualMachines/Write`	Creates/Updates virtual machine resource
`Microsoft.AzureStackHCI/VirtualMachineInstances/Write`	Creates/Updates virtual machine instance resource
`Microsoft.ExtendedLocation/customLocations/read`	Gets an Custom Location resource
`Microsoft.KubernetesConfiguration/extensions/read`	Gets extension instance resource.
`Microsoft.ResourceConnector/appliances/read`	Gets an Appliance resource
`Microsoft.Authorization/roleAssignments/write`	Create a role assignment at the specified scope.
`Microsoft.Authorization/roleAssignments/delete`	Delete a role assignment at the specified scope.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Local Migrate Owner" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Local Migrate Owner" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'fd8ea4d5-6509-4db0-bada-356ab233b4fb')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fd8ea4d5-6509-4db0-bada-356ab233b4fb')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "fd8ea4d5-6509-4db0-bada-356ab233b4fb"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other migration roles

Migrate Arc Discovery Reader - Preview · 8 permissions
Azure Migrate Service Reader · 11 permissions
Azure Local Migrate Execute Expert · 40 permissions
Azure Migrate Execute Expert · 45 permissions
Azure Migrate Decide and Plan Expert · 51 permissions
Azure Migrate Owner · 68 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles