// roles/azure · migration

Azure Migrate OwnerAzure built-in role

Grants full access to create and manage Azure Migrate projects including appliance-based discovery, creation of business case & assessment report and execution of migrations; Also grants ability to assign Azure Migrate specific roles in Azure RBAC.

Role ID	`fd8ea4d5-6509-4db0-bada-356ab233b4fa`
Category	Migration
Actions	68
Data actions	0

Before you assign it

It can give access to others. It allows Microsoft.Authorization/roleAssignments/write, so treat it as a privileged role and assign it through PIM where you can.

What it can do

Permission	What it allows
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/write`	Creates or updates a resource group.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/locations/read`	Gets the list of locations supported.
`Microsoft.Resources/checkResourceName/action`	Check the resource name for validity.
`Microsoft.Resources/deploymentScripts/write`	Creates or updates a deployment script
`Microsoft.Resources/deploymentScripts/read`	Gets or lists deployment scripts
`Microsoft.Resources/links/write`	Creates or updates a resource link.
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Authorization/locks/write`	Add locks at the specified scope.
`Microsoft.Authorization/locks/delete`	Delete locks at the specified scope.
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Migrate/*`	Every operation under Microsoft.Migrate
`Microsoft.ApplicationMigration/*`	Every operation under Microsoft.ApplicationMigration
`Microsoft.OffAzure/*`	Every operation under Microsoft.OffAzure
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.MySQLDiscovery/*`	Every operation under Microsoft.MySQLDiscovery
`Microsoft.DependencyMap/*`	Every operation under Microsoft.DependencyMap
`Microsoft.KeyVault/vaults/*`	Every operation under Microsoft.KeyVault/vaults
`Microsoft.KeyVault/checkNameAvailability/read`	Checks that a key vault name is valid and is not in use
`Microsoft.HybridCompute/machines/read`	Read any Azure Arc machines
`Microsoft.HybridCompute/machines/write`	Writes an Azure Arc machines
`Microsoft.HybridCompute/machines/delete`	Deletes an Azure Arc machines
`Microsoft.HybridCompute/register/action`	Registers the subscription for the Microsoft.HybridCompute Resource Provider
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/networkInterfaces/write`	Creates a network interface or updates an existing network interface.
`Microsoft.Network/networkInterfaces/delete`	Deletes a network interface
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/virtualNetworks/subnets/write`	Creates a virtual network subnet or updates an existing virtual network subnet
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/networkSecurityGroups/join/action`	Joins a network security group. Not Alertable.
`Microsoft.Network/virtualNetworks/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/privateEndpoints/read`	Gets an private endpoint resource.
`Microsoft.Network/privateEndpoints/write`	Creates a new private endpoint, or updates an existing private endpoint.
`Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write`	Puts a Private DNS Zone Group
`Microsoft.Network/privateDnsZones/write`	Create or update a Private DNS zone within a resource group. Note that this command cannot be used to create or update virtual network links or record sets within the zone.
`Microsoft.Network/privateDnsZones/virtualNetworkLinks/write`	Create or update a Private DNS zone link to virtual network.
`Microsoft.Network/privateDnsZones/join/action`	Joins a Private DNS Zone
`Microsoft.Network/privateDnsZones/A/write`	Create or update a record set of type 'A' within a Private DNS zone. The records specified will replace the current records in the record set.
`Microsoft.Network/register/action`	Registers the subscription
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read`	Gets a Private DNS Zone Group
`Microsoft.Storage/storageAccounts/*`	Every operation under Microsoft.Storage/storageAccounts
`Microsoft.GuestConfiguration/register/action`	Registers the subscription for the Microsoft.GuestConfiguration resource provider.
`Microsoft.Compute/register/action`	Registers Subscription with Microsoft.Compute resource provider
`Microsoft.Compute/availabilitySets/read`	Get the properties of an availability set
`Microsoft.Compute/availabilitySets/vmSizes/read`	List available sizes for creating or updating a virtual machine in the availability set
`Microsoft.Compute/diskEncryptionSets/read`	Get the properties of a disk encryption set
`Microsoft.Compute/skus/read`	Gets the list of Microsoft.Compute SKUs available for your Subscription
`Microsoft.Compute/disks/read`	Get the properties of a Disk
`Microsoft.Compute/disks/write`	Creates a new Disk or updates an existing one
`Microsoft.Compute/disks/delete`	Deletes the Disk
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/virtualMachines/write`	Creates a new virtual machine or updates an existing virtual machine
`Microsoft.Compute/virtualMachines/delete`	Deletes the virtual machine
`Microsoft.HybridConnectivity/register/action`	Register the subscription for Microsoft.HybridConnectivity
`Microsoft.RecoveryServices/vaults/*`	Every operation under Microsoft.RecoveryServices/vaults
`Microsoft.RecoveryServices/register/action`	Registers subscription for given Resource Provider
`Microsoft.RecoveryServices/operations/read`	Operation returns the list of Operations for a Resource Provider
`Microsoft.DataReplication/*/read`	Any read operation on anything under Microsoft.DataReplication
`Microsoft.DataReplication/register/action`
`Microsoft.DataReplication/replicationVaults/write`
`Microsoft.KeyVault/register/action`	Registers a subscription
`Microsoft.AzureArcData/register/action`
`Microsoft.Resources/links/read`	Gets or lists resource links.
`Microsoft.Authorization/roleAssignments/write`	Create a role assignment at the specified scope.
`Microsoft.Authorization/roleAssignments/delete`	Delete a role assignment at the specified scope.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Migrate Owner" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Migrate Owner" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'fd8ea4d5-6509-4db0-bada-356ab233b4fa')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fd8ea4d5-6509-4db0-bada-356ab233b4fa')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "fd8ea4d5-6509-4db0-bada-356ab233b4fa"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other migration roles

Migrate Arc Discovery Reader - Preview · 8 permissions
Azure Migrate Service Reader · 11 permissions
Azure Local Migrate Execute Expert · 40 permissions
Azure Migrate Execute Expert · 45 permissions
Azure Migrate Decide and Plan Expert · 51 permissions
Azure Local Migrate Owner · 64 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles