// roles/azure · migration

Azure Migrate Execute ExpertAzure built-in role

Grants restricted access on an Azure Migrate project to only perform migration related operations, including replication, execution of test migrations, tracking and monitoring of migration progress, and initiation of agentless and agent-based migrations.

Role ID	`1cfa4eac-9a23-481c-a793-bfb6958e836b`
Category	Migration
Actions	45 (minus 6 NotActions)
Data actions	0

Before you assign it

It can give access to others. It allows Microsoft.Authorization/roleAssignments/write, so treat it as a privileged role and assign it through PIM where you can.

What it can do

Permission	What it allows
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/write`	Creates or updates a resource group.
`Microsoft.Resources/subscriptions/locations/read`	Gets the list of locations supported.
`Microsoft.Resources/checkResourceName/action`	Check the resource name for validity.
`Microsoft.Resources/deploymentScripts/write`	Creates or updates a deployment script
`Microsoft.Resources/deploymentScripts/read`	Gets or lists deployment scripts
`Microsoft.Resources/links/write`	Creates or updates a resource link.
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Authorization/locks/write`	Add locks at the specified scope.
`Microsoft.Authorization/locks/delete`	Delete locks at the specified scope.
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Migrate/*/read`	Any read operation on anything under Microsoft.Migrate
`Microsoft.ApplicationMigration/*/read`	Any read operation on anything under Microsoft.ApplicationMigration
`Microsoft.OffAzure/*/read`	Any read operation on anything under Microsoft.OffAzure
`Microsoft.MySQLDiscovery/*/read`	Any read operation on anything under Microsoft.MySQLDiscovery
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/networkInterfaces/write`	Creates a network interface or updates an existing network interface.
`Microsoft.Network/networkInterfaces/delete`	Deletes a network interface
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Storage/storageAccounts/*/read`	Any read operation on anything under Microsoft.Storage/storageAccounts
`Microsoft.Storage/storageAccounts/*/write`	Any write operation on anything under Microsoft.Storage/storageAccounts
`Microsoft.Storage/storageAccounts/listKeys/action`	Returns the access keys for the specified storage account.
`Microsoft.Compute/register/action`	Registers Subscription with Microsoft.Compute resource provider
`Microsoft.Compute/availabilitySets/read`	Get the properties of an availability set
`Microsoft.Compute/availabilitySets/vmSizes/read`	List available sizes for creating or updating a virtual machine in the availability set
`Microsoft.Compute/diskEncryptionSets/read`	Get the properties of a disk encryption set
`Microsoft.Compute/skus/read`	Gets the list of Microsoft.Compute SKUs available for your Subscription
`Microsoft.Compute/disks/read`	Get the properties of a Disk
`Microsoft.Compute/disks/write`	Creates a new Disk or updates an existing one
`Microsoft.Compute/disks/delete`	Deletes the Disk
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/virtualMachines/write`	Creates a new virtual machine or updates an existing virtual machine
`Microsoft.Compute/virtualMachines/delete`	Deletes the virtual machine
`Microsoft.RecoveryServices/vaults/*`	Every operation under Microsoft.RecoveryServices/vaults
`Microsoft.RecoveryServices/register/action`	Registers subscription for given Resource Provider
`Microsoft.RecoveryServices/operations/read`	Operation returns the list of Operations for a Resource Provider
`Microsoft.Resources/links/read`	Gets or lists resource links.
`Microsoft.DependencyMap/*/read`	Any read operation on anything under Microsoft.DependencyMap
`Microsoft.DependencyMap/maps/*/action`	Any action on anything under Microsoft.DependencyMap/maps
`Microsoft.Authorization/roleAssignments/write`	Create a role assignment at the specified scope.
`Microsoft.Authorization/roleAssignments/delete`	Delete a role assignment at the specified scope.

Can't do

These are taken away from the actions above.

Permission	What it allows
`Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*`	Every operation under Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates
`Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*`	Every operation under Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities
`Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*`	Every operation under Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates
`Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*`	Every operation under Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities
`Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*`	Every operation under Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities
`Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*`	Every operation under Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Migrate Execute Expert" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Migrate Execute Expert" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '1cfa4eac-9a23-481c-a793-bfb6958e836b')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1cfa4eac-9a23-481c-a793-bfb6958e836b')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "1cfa4eac-9a23-481c-a793-bfb6958e836b"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other migration roles

Migrate Arc Discovery Reader - Preview · 8 permissions
Azure Migrate Service Reader · 11 permissions
Azure Local Migrate Execute Expert · 40 permissions
Azure Migrate Decide and Plan Expert · 51 permissions
Azure Local Migrate Owner · 64 permissions
Azure Migrate Owner · 68 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles