// roles/azure · hybrid-multicloud

Azure Stack HCI Device Management RoleAzure built-in role

Microsoft.AzureStackHCI Device Management Role

Role ID	`865ae368-6a45-4bd1-8fbf-0d5151f56fc1`
Category	Hybrid-multicloud
Actions	37
Data actions	0

What it can do

Permission	What it allows
`Microsoft.AzureStackHCI/Clusters/*`	Every operation under Microsoft.AzureStackHCI/Clusters
`Microsoft.AzureStackHCI/EdgeDevices/*`	Every operation under Microsoft.AzureStackHCI/EdgeDevices
`Microsoft.AzureStackHCI/DevicePools/*/read`	Any read operation on anything under Microsoft.AzureStackHCI/DevicePools
`Microsoft.AzureStackHCI/EdgeMachines/*/read`	Any read operation on anything under Microsoft.AzureStackHCI/EdgeMachines
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.HybridContainerService/register/action`	Register the subscription for Microsoft.HybridContainerService
`Microsoft.HybridContainerService/kubernetesVersions/read`	Gets the supported kubernetes versions from the underlying custom location
`Microsoft.HybridContainerService/kubernetesVersions/write`	Puts the kubernetes version resource type
`Microsoft.HybridContainerService/skus/read`	Gets the supported VM skus from the underlying custom location
`Microsoft.HybridContainerService/skus/write`	Puts the VM SKUs resource type
`Microsoft.Authorization/roleassignments/read`	Get information about a role assignment.
`Microsoft.AzureStackHCI/StorageContainers/Write`	Creates/Updates storage containers resource
`Microsoft.AzureStackHCI/StorageContainers/Read`	Gets/Lists storage containers resource
`Microsoft.AzureStackHCI/LogicalNetworks/Read`	Gets/Lists logical networks resource
`Microsoft.AzureStackHCI/LogicalNetworks/Write`	Creates/Updates logical networks resource
`Microsoft.AzureStackHCI/Register/Action`	Registers the subscription for the Azure Local resource provider and enables the creation of Azure Local resources.
`Microsoft.GuestConfiguration/guestConfigurationAssignments/read`	Get guest configuration assignment.
`Microsoft.KubernetesConfiguration/extensions/write`	Creates or updates extension resource.
`Microsoft.KubernetesConfiguration/extensions/read`	Gets extension instance resource.
`Microsoft.KubernetesConfiguration/extensions/delete`	Deletes extension instance resource.
`Microsoft.KubernetesConfiguration/extensions/operations/read`	Gets Async Operation status.
`Microsoft.KubernetesConfiguration/namespaces/read`	Get Namespace Resource
`Microsoft.KubernetesConfiguration/operations/read`	Gets available operations of the Microsoft.KubernetesConfiguration resource provider.
`Microsoft.ResourceConnector/appliances/read`	Gets an Appliance resource
`Microsoft.ResourceConnector/appliances/write`	Creates or Updates Appliance resource
`Microsoft.ResourceConnector/appliances/delete`	Deletes Appliance resource
`Microsoft.ResourceConnector/locations/operationresults/read`	Get result of Appliance operation
`Microsoft.ResourceConnector/locations/operationsstatus/read`	Get result of Appliance operation
`Microsoft.ResourceConnector/appliances/listClusterUserCredential/action`	Get an appliance cluster user credential
`Microsoft.ResourceConnector/appliances/listKeys/action`	Get an appliance cluster customer user keys
`Microsoft.ResourceConnector/appliances/upgradeGraphs/read`	Gets the upgrade graph of Appliance cluster
`Microsoft.ResourceConnector/telemetryconfig/read`	Get Appliances telemetry config utilized by Appliances CLI
`Microsoft.ResourceConnector/operations/read`	Gets list of Available Operations for Appliances
`Microsoft.ExtendedLocation/customLocations/deploy/action`	Deploy permissions to a Custom Location resource
`Microsoft.ExtendedLocation/customLocations/read`	Gets an Custom Location resource
`Microsoft.ExtendedLocation/customLocations/write`	Creates or Updates Custom Location resource
`Microsoft.ExtendedLocation/customLocations/delete`	Deletes Custom Location resource

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Stack HCI Device Management Role" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Stack HCI Device Management Role" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '865ae368-6a45-4bd1-8fbf-0d5151f56fc1')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '865ae368-6a45-4bd1-8fbf-0d5151f56fc1')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "865ae368-6a45-4bd1-8fbf-0d5151f56fc1"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other hybrid-multicloud roles

Hybrid Server Resource Administrator · 2 permissions
Azure Stack Registration Owner · 4 permissions
Azure Stack HCI Connected InfraVMs · 7 permissions
Arc Gateway Manager · 9 permissions
Azure Arc ScVmm Private Clouds Onboarding · 30 permissions
Azure Arc ScVmm Private Cloud User · 34 permissions
Azure Resource Bridge Deployment Role · 36 permissions
Azure Stack HCI VM Reader · 42 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles