// roles/azure · hybrid-multicloud

Azure Stack HCI VM ContributorAzure built-in role

Grants permissions to perform all VM actions

Role ID	`874d1c73-6003-4e60-a13a-cb31ea190a85`
Category	Hybrid-multicloud
Actions	75
Data actions	0

What it can do

Permission	What it allows
`Microsoft.AzureStackHCI/VirtualMachines/*`	Every operation under Microsoft.AzureStackHCI/VirtualMachines
`Microsoft.AzureStackHCI/virtualMachineInstances/*`	Every operation under Microsoft.AzureStackHCI/virtualMachineInstances
`Microsoft.AzureStackHCI/NetworkInterfaces/*`	Every operation under Microsoft.AzureStackHCI/NetworkInterfaces
`Microsoft.AzureStackHCI/VirtualHardDisks/*`	Every operation under Microsoft.AzureStackHCI/VirtualHardDisks
`Microsoft.AzureStackHCI/VirtualNetworks/Read`	Gets/Lists virtual networks resource
`Microsoft.AzureStackHCI/VirtualNetworks/join/action`	Joins virtual networks resource
`Microsoft.AzureStackHCI/LogicalNetworks/Read`	Gets/Lists logical networks resource
`Microsoft.AzureStackHCI/LogicalNetworks/join/action`	Joins logical networks resource
`Microsoft.AzureStackHCI/GalleryImages/Read`	Gets/Lists gallery images resource
`Microsoft.AzureStackHCI/GalleryImages/deploy/action`	Deploys gallery images resource
`Microsoft.AzureStackHCI/StorageContainers/Read`	Gets/Lists storage containers resource
`Microsoft.AzureStackHCI/StorageContainers/deploy/action`	Deploys storage containers resource
`Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read`	Gets/Lists market place gallery images resource
`Microsoft.AzureStackHCI/MarketPlaceGalleryImages/deploy/action`	Deploys market place gallery images resource
`Microsoft.AzureStackHCI/Clusters/Read`	Gets clusters
`Microsoft.AzureStackHCI/Clusters/ArcSettings/Read`	Gets Arc resource of Azure Local cluster
`Microsoft.AzureStackHCI/NetworkSecurityGroups/Read`	Gets/Lists a network security group resource
`Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read`	Gets/Lists security rule resource
`Microsoft.Insights/AlertRules/Write`	Create or update a classic metric alert
`Microsoft.Insights/AlertRules/Delete`	Delete a classic metric alert
`Microsoft.Insights/AlertRules/Read`	Read a classic metric alert
`Microsoft.Insights/AlertRules/Activated/Action`	Classic metric alert activated
`Microsoft.Insights/AlertRules/Resolved/Action`	Classic metric alert resolved
`Microsoft.Insights/AlertRules/Throttled/Action`	Classic metric alert rule throttled
`Microsoft.Insights/AlertRules/Incidents/Read`	Read a classic metric alert incident
`Microsoft.Resources/deployments/read`	Gets or lists deployments.
`Microsoft.Resources/deployments/write`	Creates or updates an deployment.
`Microsoft.Resources/deployments/delete`	Deletes a deployment.
`Microsoft.Resources/deployments/cancel/action`	Cancels a deployment.
`Microsoft.Resources/deployments/validate/action`	Validates a deployment.
`Microsoft.Resources/deployments/whatIf/action`	Predicts template deployment changes.
`Microsoft.Resources/deployments/exportTemplate/action`	Export template for a deployment
`Microsoft.Resources/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/deployments/operationstatuses/read`	Gets or lists deployment operation statuses.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/read`	Gets or lists deployments.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/write`	Creates or updates an deployment.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read`	Gets or lists deployment operation statuses.
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/subscriptions/operationresults/read`	Get the subscription operation results.
`Microsoft.HybridCompute/machines/read`	Read any Azure Arc machines
`Microsoft.HybridCompute/machines/write`	Writes an Azure Arc machines
`Microsoft.HybridCompute/machines/delete`	Deletes an Azure Arc machines
`Microsoft.HybridCompute/machines/UpgradeExtensions/action`	Upgrades Extensions on Azure Arc machines
`Microsoft.HybridCompute/machines/assessPatches/action`	Assesses any Azure Arc machines to get missing software patches
`Microsoft.HybridCompute/machines/installPatches/action`	Installs patches on any Azure Arc machines
`Microsoft.HybridCompute/machines/extensions/read`	Reads any Azure Arc extensions
`Microsoft.HybridCompute/machines/extensions/write`	Installs or Updates an Azure Arc extensions
`Microsoft.HybridCompute/machines/extensions/delete`	Deletes an Azure Arc extensions
`Microsoft.HybridCompute/operations/read`	Read all Operations for Azure Arc for Servers
`Microsoft.HybridCompute/locations/operationresults/read`	Reads the status of an operation on Microsoft.HybridCompute Resource Provider
`Microsoft.HybridCompute/locations/operationstatus/read`	Reads the status of an operation on Microsoft.HybridCompute Resource Provider
`Microsoft.HybridCompute/machines/patchAssessmentResults/read`	Reads any Azure Arc patchAssessmentResults
`Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read`	Reads any Azure Arc patchAssessmentResults/softwarePatches
`Microsoft.HybridCompute/machines/patchInstallationResults/read`	Reads any Azure Arc patchInstallationResults
`Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read`	Reads any Azure Arc patchInstallationResults/softwarePatches
`Microsoft.HybridCompute/locations/updateCenterOperationResults/read`	Reads the status of an update center operation on machines
`Microsoft.HybridCompute/machines/hybridIdentityMetadata/read`	Read any Azure Arc machines's Hybrid Identity Metadata
`Microsoft.HybridCompute/osType/agentVersions/read`	Read all Azure Connected Machine Agent versions available
`Microsoft.HybridCompute/osType/agentVersions/latest/read`	Read the latest Azure Connected Machine Agent version
`Microsoft.HybridCompute/machines/runcommands/read`	Reads any Azure Arc runcommands
`Microsoft.HybridCompute/machines/runcommands/write`	Installs or Updates an Azure Arc runcommands
`Microsoft.HybridCompute/machines/runcommands/delete`	Deletes an Azure Arc runcommands
`Microsoft.HybridCompute/machines/licenseProfiles/read`	Reads any Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/licenseProfiles/write`	Installs or Updates an Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/licenseProfiles/delete`	Deletes an Azure Arc licenseProfiles
`Microsoft.HybridCompute/licenses/read`	Reads any Azure Arc licenses
`Microsoft.HybridCompute/licenses/write`	Installs or Updates an Azure Arc licenses
`Microsoft.HybridCompute/licenses/delete`	Deletes an Azure Arc licenses
`Microsoft.ExtendedLocation/customLocations/Read`	Gets an Custom Location resource
`Microsoft.ExtendedLocation/customLocations/deploy/action`	Deploy permissions to a Custom Location resource
`Microsoft.KubernetesConfiguration/extensions/read`	Gets extension instance resource.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Stack HCI VM Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Stack HCI VM Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '874d1c73-6003-4e60-a13a-cb31ea190a85')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '874d1c73-6003-4e60-a13a-cb31ea190a85')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "874d1c73-6003-4e60-a13a-cb31ea190a85"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other hybrid-multicloud roles

Hybrid Server Resource Administrator · 2 permissions
Azure Stack Registration Owner · 4 permissions
Azure Stack HCI Connected InfraVMs · 7 permissions
Arc Gateway Manager · 9 permissions
Azure Arc ScVmm Private Clouds Onboarding · 30 permissions
Azure Arc ScVmm Private Cloud User · 34 permissions
Azure Resource Bridge Deployment Role · 36 permissions
Azure Stack HCI Device Management Role · 37 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles