// roles/azure · hybrid-multicloud

Azure Stack HCI VM ReaderAzure built-in role

Grants permissions to view VMs

Role ID	`4b3fe76c-f777-4d24-a2d7-b027b0f7b273`
Category	Hybrid-multicloud
Actions	42
Data actions	0

What it can do

Permission	What it allows
`Microsoft.AzureStackHCI/VirtualMachines/Read`	Gets/Lists virtual machine resource
`Microsoft.AzureStackHCI/virtualMachineInstances/Read`	Gets/Lists virtual machine instance resource
`Microsoft.AzureStackHCI/VirtualMachines/Extensions/Read`	Gets/Lists virtual machine extensions resource
`Microsoft.AzureStackHCI/VirtualNetworks/Read`	Gets/Lists virtual networks resource
`Microsoft.AzureStackHCI/LogicalNetworks/Read`	Gets/Lists logical networks resource
`Microsoft.AzureStackHCI/NetworkInterfaces/Read`	Gets/Lists network interfaces resource
`Microsoft.AzureStackHCI/VirtualHardDisks/Read`	Gets/Lists virtual hard disk resource
`Microsoft.AzureStackHCI/StorageContainers/Read`	Gets/Lists storage containers resource
`Microsoft.AzureStackHCI/GalleryImages/Read`	Gets/Lists gallery images resource
`Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read`	Gets/Lists market place gallery images resource
`Microsoft.AzureStackHCI/NetworkSecurityGroups/Read`	Gets/Lists a network security group resource
`Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read`	Gets/Lists security rule resource
`Microsoft.HybridCompute/licenses/read`	Reads any Azure Arc licenses
`Microsoft.HybridCompute/machines/extensions/read`	Reads any Azure Arc extensions
`Microsoft.HybridCompute/machines/licenseProfiles/read`	Reads any Azure Arc licenseProfiles
`Microsoft.HybridCompute/machines/patchAssessmentResults/read`	Reads any Azure Arc patchAssessmentResults
`Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read`	Reads any Azure Arc patchAssessmentResults/softwarePatches
`Microsoft.HybridCompute/machines/patchInstallationResults/read`	Reads any Azure Arc patchInstallationResults
`Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read`	Reads any Azure Arc patchInstallationResults/softwarePatches
`Microsoft.HybridCompute/machines/read`	Read any Azure Arc machines
`Microsoft.HybridCompute/privateLinkScopes/networkSecurityPerimeterConfigurations/read`	Reads any Azure Arc networkSecurityPerimeterConfigurations
`Microsoft.HybridCompute/privateLinkScopes/privateEndpointConnections/read`	Read any Azure Arc privateEndpointConnections
`Microsoft.HybridCompute/privateLinkScopes/read`	Read any Azure Arc privateLinkScopes
`Microsoft.Insights/AlertRules/Write`	Create or update a classic metric alert
`Microsoft.Insights/AlertRules/Delete`	Delete a classic metric alert
`Microsoft.Insights/AlertRules/Read`	Read a classic metric alert
`Microsoft.Insights/AlertRules/Activated/Action`	Classic metric alert activated
`Microsoft.Insights/AlertRules/Resolved/Action`	Classic metric alert resolved
`Microsoft.Insights/AlertRules/Throttled/Action`	Classic metric alert rule throttled
`Microsoft.Insights/AlertRules/Incidents/Read`	Read a classic metric alert incident
`Microsoft.Resources/deployments/read`	Gets or lists deployments.
`Microsoft.Resources/deployments/exportTemplate/action`	Export template for a deployment
`Microsoft.Resources/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/deployments/operationstatuses/read`	Gets or lists deployment operation statuses.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/read`	Gets or lists deployments.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read`	Gets or lists deployment operation statuses.
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/subscriptions/operationresults/read`	Get the subscription operation results.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Stack HCI VM Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Stack HCI VM Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '4b3fe76c-f777-4d24-a2d7-b027b0f7b273')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4b3fe76c-f777-4d24-a2d7-b027b0f7b273')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "4b3fe76c-f777-4d24-a2d7-b027b0f7b273"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other hybrid-multicloud roles

Hybrid Server Resource Administrator · 2 permissions
Azure Stack Registration Owner · 4 permissions
Azure Stack HCI Connected InfraVMs · 7 permissions
Arc Gateway Manager · 9 permissions
Azure Arc ScVmm Private Clouds Onboarding · 30 permissions
Azure Arc ScVmm Private Cloud User · 34 permissions
Azure Resource Bridge Deployment Role · 36 permissions
Azure Stack HCI Device Management Role · 37 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles