// roles/azure · compute

Desktop Virtualization Power On Off ContributorAzure built-in role

Provide permission to the Azure Virtual Desktop Resource Provider to start and stop virtual machines.

Role ID	`40c5ff49-9181-41f8-ae61-143b0e78555e`
Category	Compute
Actions	37
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.AzureStackHCI/operations/read`	Gets operations
`Microsoft.AzureStackHCI/virtualMachineInstances/read`	Gets/Lists virtual machine instance resource
`Microsoft.AzureStackHCI/virtualMachineInstances/restart/action`	Restarts virtual machine instance resource
`Microsoft.AzureStackHCI/virtualMachineInstances/start/action`	Starts virtual machine instance resource
`Microsoft.AzureStackHCI/virtualMachineInstances/stop/action`	Stops virtual machine instance resource
`Microsoft.Compute/virtualMachines/deallocate/action`	Powers off the virtual machine and releases the compute resources
`Microsoft.Compute/virtualMachines/instanceView/read`	Gets the detailed runtime status of the virtual machine and its resources
`Microsoft.Compute/virtualMachines/powerOff/action`	Powers off the virtual machine. Note that the virtual machine will continue to be billed.
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/virtualMachines/restart/action`	Restarts the virtual machine
`Microsoft.Compute/virtualMachines/start/action`	Starts the virtual machine
`Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action`	virtualMachinesCancelOperations: cancelOperations for a virtual machine
`Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action`	VirtualMachinesExecuteDeallocate: Execute deallocate operation for a batch of virtual machines, this operation is triggered as soon as Computeschedule receives it.
`Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action`	VirtualMachinesExecuteHibernate: Execute hibernate operation for a batch of virtual machines, this operation is triggered as soon as Computeschedule receives it.
`Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action`	VirtualMachinesExecuteStart: Execute start operation for a batch of virtual machines, this operation is triggered as soon as Computeschedule receives it.
`Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action`	VirtualMachinesGetOperationErrors: Get error details on operation errors (like transient errors encountered, additional logs) if they exist.
`Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action`	VirtualMachinesGetOperationStatus: Polling endpoint to read status of operations performed on virtual machines
`Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action`	VirtualMachinesSubmitDeallocate: Schedule deallocate operation for a batch of virtual machines at datetime in future.
`Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action`	VirtualMachinesSubmitHibernate: Schedule hibernate operation for a batch of virtual machines at datetime in future.
`Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action`	VirtualMachinesSubmitStart: Schedule start operation for a batch of virtual machines at datetime in future.
`Microsoft.ComputeSchedule/register/action`	Register the subscription for Microsoft.ComputeSchedule
`Microsoft.DesktopVirtualization/hostpools/read`	Read hostpools
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/read`	Read hostpools/sessionhosts
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/delete`	Delete hostpools/sessionhosts/usersessions
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read`	Read hostpools/sessionhosts/usersessions
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action`	Send message to user session
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/write`	Write hostpools/sessionhosts
`Microsoft.DesktopVirtualization/hostpools/write`	Write hostpools
`Microsoft.HybridCompute/locations/operationresults/read`	Reads the status of an operation on Microsoft.HybridCompute Resource Provider
`Microsoft.HybridCompute/locations/operationstatus/read`	Reads the status of an operation on Microsoft.HybridCompute Resource Provider
`Microsoft.HybridCompute/machines/read`	Read any Azure Arc machines
`Microsoft.HybridCompute/operations/read`	Read all Operations for Azure Arc for Servers
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Insights/eventtypes/values/read`	Read Activity Log events
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Desktop Virtualization Power On Off Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Desktop Virtualization Power On Off Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '40c5ff49-9181-41f8-ae61-143b0e78555e')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '40c5ff49-9181-41f8-ae61-143b0e78555e')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "40c5ff49-9181-41f8-ae61-143b0e78555e"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other compute roles

Compute Gallery Sharing Admin · 1 permission
Compute Gallery Image Reader · 2 permissions
Desktop Virtualization User · 2 permissions
Virtual Machine Local User Login · 2 permissions
Azure Batch Account Reader · 3 permissions
Disk Backup Reader · 3 permissions
Data Operator for Managed Disks · 4 permissions
Windows 365 Network User · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles