// roles/azure · hybrid-multicloud

Azure Resource Bridge Deployment RoleAzure built-in role

Azure Resource Bridge Deployment Role

Role ID	`7b1f81f9-4196-4058-8aae-762e593270df`
Category	Hybrid-multicloud
Actions	36
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/roleassignments/read`	Get information about a role assignment.
`Microsoft.AzureStackHCI/Register/Action`	Registers the subscription for the Azure Local resource provider and enables the creation of Azure Local resources.
`Microsoft.ResourceConnector/register/action`	Registers the subscription for Appliances resource provider and enables the creation of Appliance.
`Microsoft.ResourceConnector/appliances/read`	Gets an Appliance resource
`Microsoft.ResourceConnector/appliances/write`	Creates or Updates Appliance resource
`Microsoft.ResourceConnector/appliances/delete`	Deletes Appliance resource
`Microsoft.ResourceConnector/locations/operationresults/read`	Get result of Appliance operation
`Microsoft.ResourceConnector/locations/operationsstatus/read`	Get result of Appliance operation
`Microsoft.ResourceConnector/appliances/listClusterUserCredential/action`	Get an appliance cluster user credential
`Microsoft.ResourceConnector/appliances/listKeys/action`	Get an appliance cluster customer user keys
`Microsoft.ResourceConnector/appliances/upgradeGraphs/read`	Gets the upgrade graph of Appliance cluster
`Microsoft.ResourceConnector/telemetryconfig/read`	Get Appliances telemetry config utilized by Appliances CLI
`Microsoft.ResourceConnector/operations/read`	Gets list of Available Operations for Appliances
`Microsoft.ExtendedLocation/register/action`	Registers the subscription for Custom Location resource provider and enables the creation of Custom Location.
`Microsoft.ExtendedLocation/customLocations/deploy/action`	Deploy permissions to a Custom Location resource
`Microsoft.ExtendedLocation/customLocations/read`	Gets an Custom Location resource
`Microsoft.ExtendedLocation/customLocations/write`	Creates or Updates Custom Location resource
`Microsoft.ExtendedLocation/customLocations/delete`	Deletes Custom Location resource
`Microsoft.HybridConnectivity/register/action`	Register the subscription for Microsoft.HybridConnectivity
`Microsoft.Kubernetes/register/action`	Registers Subscription with Microsoft.Kubernetes resource provider
`Microsoft.KubernetesConfiguration/register/action`	Registers subscription to Microsoft.KubernetesConfiguration resource provider.
`Microsoft.KubernetesConfiguration/extensions/write`	Creates or updates extension resource.
`Microsoft.KubernetesConfiguration/extensions/read`	Gets extension instance resource.
`Microsoft.KubernetesConfiguration/extensions/delete`	Deletes extension instance resource.
`Microsoft.KubernetesConfiguration/extensions/operations/read`	Gets Async Operation status.
`Microsoft.KubernetesConfiguration/namespaces/read`	Get Namespace Resource
`Microsoft.KubernetesConfiguration/operations/read`	Gets available operations of the Microsoft.KubernetesConfiguration resource provider.
`Microsoft.GuestConfiguration/guestConfigurationAssignments/read`	Get guest configuration assignment.
`Microsoft.HybridContainerService/register/action`	Register the subscription for Microsoft.HybridContainerService
`Microsoft.HybridContainerService/kubernetesVersions/read`	Gets the supported kubernetes versions from the underlying custom location
`Microsoft.HybridContainerService/kubernetesVersions/write`	Puts the kubernetes version resource type
`Microsoft.HybridContainerService/skus/read`	Gets the supported VM skus from the underlying custom location
`Microsoft.HybridContainerService/skus/write`	Puts the VM SKUs resource type
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.AzureStackHCI/StorageContainers/Write`	Creates/Updates storage containers resource
`Microsoft.AzureStackHCI/StorageContainers/Read`	Gets/Lists storage containers resource

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Resource Bridge Deployment Role" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Resource Bridge Deployment Role" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '7b1f81f9-4196-4058-8aae-762e593270df')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7b1f81f9-4196-4058-8aae-762e593270df')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "7b1f81f9-4196-4058-8aae-762e593270df"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other hybrid-multicloud roles

Hybrid Server Resource Administrator · 2 permissions
Azure Stack Registration Owner · 4 permissions
Azure Stack HCI Connected InfraVMs · 7 permissions
Arc Gateway Manager · 9 permissions
Azure Arc ScVmm Private Clouds Onboarding · 30 permissions
Azure Arc ScVmm Private Cloud User · 34 permissions
Azure Stack HCI Device Management Role · 37 permissions
Azure Stack HCI VM Reader · 42 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles