// roles/azure · hybrid-multicloud

Azure Stack HCI AdministratorAzure built-in role

Grants full access to the cluster and its resources, including the ability to register Azure Stack HCI and assign others as Azure Arc HCI VM Contributor and/or Azure Arc HCI VM Reader

Role ID	`bda0d508-adf1-4af0-9c28-88919fc3ae06`
Category	Hybrid-multicloud
Actions	101
Data actions	0

Before you assign it

It can give access to others. It allows Microsoft.Authorization/roleAssignments/write, so treat it as a privileged role and assign it through PIM where you can.

What it can do

Permission	What it allows
`Microsoft.AzureStackHCI/register/action`	Registers the subscription for the Azure Local resource provider and enables the creation of Azure Local resources.
`Microsoft.AzureStackHCI/Unregister/Action`	Unregisters the subscription for the Azure Local resource provider.
`Microsoft.AzureStackHCI/clusters/*`	Every operation under Microsoft.AzureStackHCI/clusters
`Microsoft.AzureStackHCI/NetworkSecurityGroups/Read`	Gets/Lists a network security group resource
`Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read`	Gets/Lists security rule resource
`Microsoft.AzureStackHCI/NetworkSecurityGroups/Write`	Creates/Updates a network security group resource
`Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Write`	Creates/Updates security rule resource
`Microsoft.AzureStackHCI/NetworkSecurityGroups/Delete`	Deletes a network security group resource
`Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Delete`	Deletes a security rule resource
`Microsoft.AzureStackHCI/NetworkSecurityGroups/join/action`	Joins network security group resource
`Microsoft.HybridCompute/register/action`	Registers the subscription for the Microsoft.HybridCompute Resource Provider
`Microsoft.GuestConfiguration/register/action`	Registers the subscription for the Microsoft.GuestConfiguration resource provider.
`Microsoft.GuestConfiguration/guestConfigurationAssignments/read`	Get guest configuration assignment.
`Microsoft.Resources/subscriptions/resourceGroups/write`	Creates or updates a resource group.
`Microsoft.Resources/subscriptions/resourceGroups/delete`	Deletes a resource group and all its resources.
`Microsoft.HybridConnectivity/register/action`	Register the subscription for Microsoft.HybridConnectivity
`Microsoft.Authorization/roleAssignments/write`	Create a role assignment at the specified scope.
`Microsoft.Authorization/roleAssignments/delete`	Delete a role assignment at the specified scope.
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Management/managementGroups/read`	List management groups for the authenticated user.
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.AzureStackHCI/*`	Every operation under Microsoft.AzureStackHCI
`Microsoft.AzureStackHCI/EdgeMachines/*`	Every operation under Microsoft.AzureStackHCI/EdgeMachines
`Microsoft.AzureStackHCI/DevicePools/*`	Every operation under Microsoft.AzureStackHCI/DevicePools
`Microsoft.Insights/AlertRules/Write`	Create or update a classic metric alert
`Microsoft.Insights/AlertRules/Delete`	Delete a classic metric alert
`Microsoft.Insights/AlertRules/Read`	Read a classic metric alert
`Microsoft.Insights/AlertRules/Activated/Action`	Classic metric alert activated
`Microsoft.Insights/AlertRules/Resolved/Action`	Classic metric alert resolved
`Microsoft.Insights/AlertRules/Throttled/Action`	Classic metric alert rule throttled
`Microsoft.Insights/AlertRules/Incidents/Read`	Read a classic metric alert incident
`Microsoft.Resources/subscriptions/resourcegroups/deployments/read`	Gets or lists deployments.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/write`	Creates or updates an deployment.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read`	Gets or lists deployment operation statuses.
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Resources/subscriptions/operationresults/read`	Get the subscription operation results.
`Microsoft.HybridCompute/machines/read`	Read any Azure Arc machines
`Microsoft.HybridCompute/machines/write`	Writes an Azure Arc machines
`Microsoft.HybridCompute/machines/delete`	Deletes an Azure Arc machines
`Microsoft.HybridCompute/machines/UpgradeExtensions/action`	Upgrades Extensions on Azure Arc machines
`Microsoft.HybridCompute/machines/assessPatches/action`	Assesses any Azure Arc machines to get missing software patches
`Microsoft.HybridCompute/machines/installPatches/action`	Installs patches on any Azure Arc machines
`Microsoft.HybridCompute/machines/extensions/read`	Reads any Azure Arc extensions
`Microsoft.HybridCompute/machines/extensions/write`	Installs or Updates an Azure Arc extensions
`Microsoft.HybridCompute/machines/extensions/delete`	Deletes an Azure Arc extensions
`Microsoft.HybridCompute/operations/read`	Read all Operations for Azure Arc for Servers
`Microsoft.HybridCompute/locations/operationresults/read`	Reads the status of an operation on Microsoft.HybridCompute Resource Provider
`Microsoft.HybridCompute/locations/operationstatus/read`	Reads the status of an operation on Microsoft.HybridCompute Resource Provider
`Microsoft.HybridCompute/machines/patchAssessmentResults/read`	Reads any Azure Arc patchAssessmentResults
`Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read`	Reads any Azure Arc patchAssessmentResults/softwarePatches
`Microsoft.HybridCompute/machines/patchInstallationResults/read`	Reads any Azure Arc patchInstallationResults
`Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read`	Reads any Azure Arc patchInstallationResults/softwarePatches
`Microsoft.HybridCompute/locations/updateCenterOperationResults/read`	Reads the status of an update center operation on machines
`Microsoft.HybridCompute/machines/hybridIdentityMetadata/read`	Read any Azure Arc machines's Hybrid Identity Metadata
`Microsoft.HybridCompute/osType/agentVersions/read`	Read all Azure Connected Machine Agent versions available
`Microsoft.HybridCompute/osType/agentVersions/latest/read`	Read the latest Azure Connected Machine Agent version
`Microsoft.HybridCompute/machines/runcommands/read`	Reads any Azure Arc runcommands
`Microsoft.HybridCompute/machines/runcommands/write`	Installs or Updates an Azure Arc runcommands
`Microsoft.HybridCompute/machines/runcommands/delete`	Deletes an Azure Arc runcommands
`Microsoft.HybridCompute/machines/licenseProfiles/read`	Reads any Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/licenseProfiles/write`	Installs or Updates an Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/licenseProfiles/delete`	Deletes an Azure Arc licenseProfiles
`Microsoft.HybridCompute/licenses/read`	Reads any Azure Arc licenses
`Microsoft.HybridCompute/licenses/write`	Installs or Updates an Azure Arc licenses
`Microsoft.HybridCompute/licenses/delete`	Deletes an Azure Arc licenses
`Microsoft.ResourceConnector/register/action`	Registers the subscription for Appliances resource provider and enables the creation of Appliance.
`Microsoft.ResourceConnector/appliances/read`	Gets an Appliance resource
`Microsoft.ResourceConnector/appliances/write`	Creates or Updates Appliance resource
`Microsoft.ResourceConnector/appliances/delete`	Deletes Appliance resource
`Microsoft.ResourceConnector/locations/operationresults/read`	Get result of Appliance operation
`Microsoft.ResourceConnector/locations/operationsstatus/read`	Get result of Appliance operation
`Microsoft.ResourceConnector/appliances/listClusterUserCredential/action`	Get an appliance cluster user credential
`Microsoft.ResourceConnector/appliances/listKeys/action`	Get an appliance cluster customer user keys
`Microsoft.ResourceConnector/operations/read`	Gets list of Available Operations for Appliances
`Microsoft.ExtendedLocation/register/action`	Registers the subscription for Custom Location resource provider and enables the creation of Custom Location.
`Microsoft.ExtendedLocation/customLocations/read`	Gets an Custom Location resource

Showing 80 of 101.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Stack HCI Administrator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Stack HCI Administrator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'bda0d508-adf1-4af0-9c28-88919fc3ae06')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'bda0d508-adf1-4af0-9c28-88919fc3ae06')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "bda0d508-adf1-4af0-9c28-88919fc3ae06"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other hybrid-multicloud roles

Hybrid Server Resource Administrator · 2 permissions
Azure Stack Registration Owner · 4 permissions
Azure Stack HCI Connected InfraVMs · 7 permissions
Arc Gateway Manager · 9 permissions
Azure Arc ScVmm Private Clouds Onboarding · 30 permissions
Azure Arc ScVmm Private Cloud User · 34 permissions
Azure Resource Bridge Deployment Role · 36 permissions
Azure Stack HCI Device Management Role · 37 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles