// roles/azure · compute

Desktop Virtualization Virtual Machine ContributorAzure built-in role

This role is in preview and subject to change. Provide permission to the Azure Virtual Desktop Resource Provider to create, delete, update, start, and stop virtual machines.

Role ID	`a959dbd1-f747-45e3-8ba6-dd80f235f97c`
Category	Compute
Actions	58
Data actions	0

What it can do

Permission	What it allows
`Microsoft.DesktopVirtualization/hostpools/read`	Read hostpools
`Microsoft.DesktopVirtualization/hostpools/write`	Write hostpools
`Microsoft.DesktopVirtualization/hostpools/retrieveRegistrationToken/action`	Retrieve registration token for host pool
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/read`	Read hostpools/sessionhosts
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/write`	Write hostpools/sessionhosts
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/delete`	Delete hostpools/sessionhosts
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read`	Read hostpools/sessionhosts/usersessions
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/disconnect/action`	Disconnects the user session form session host
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action`	Send message to user session
`Microsoft.DesktopVirtualization/hostpools/sessionHostConfigurations/read`	Read hostpools/sessionhostconfigurations
`Microsoft.DesktopVirtualization/hostpools/doNotUseInternalAPI/action`	Internal operation that is not meant to be called by customers. This will be removed in a future version. Do not use it.
`Microsoft.DesktopVirtualization/hostpools/sessionhosts/retryprovisioning/action`	Action on retryprovisioning.
`Microsoft.Compute/availabilitySets/read`	Get the properties of an availability set
`Microsoft.Compute/availabilitySets/write`	Creates a new availability set or updates an existing one
`Microsoft.Compute/availabilitySets/vmSizes/read`	List available sizes for creating or updating a virtual machine in the availability set
`Microsoft.Compute/disks/read`	Get the properties of a Disk
`Microsoft.Compute/disks/write`	Creates a new Disk or updates an existing one
`Microsoft.Compute/disks/delete`	Deletes the Disk
`Microsoft.Compute/galleries/read`	Gets the properties of Gallery
`Microsoft.Compute/galleries/images/read`	Gets the properties of Gallery Image
`Microsoft.Compute/galleries/images/versions/read`	Gets the properties of Gallery Image Version
`Microsoft.Compute/images/read`	Get the properties of the Image
`Microsoft.Compute/locations/usages/read`	Gets service limits and current usage quantities for the subscription's compute resources in a location
`Microsoft.Compute/locations/vmSizes/read`	Lists available virtual machine sizes in a location
`Microsoft.Compute/operations/read`	Lists operations available on Microsoft.Compute resource provider
`Microsoft.Compute/skus/read`	Gets the list of Microsoft.Compute SKUs available for your Subscription
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/virtualMachines/write`	Creates a new virtual machine or updates an existing virtual machine
`Microsoft.Compute/virtualMachines/delete`	Deletes the virtual machine
`Microsoft.Compute/virtualMachines/start/action`	Starts the virtual machine
`Microsoft.Compute/virtualMachines/powerOff/action`	Powers off the virtual machine. Note that the virtual machine will continue to be billed.
`Microsoft.Compute/virtualMachines/restart/action`	Restarts the virtual machine
`Microsoft.Compute/virtualMachines/deallocate/action`	Powers off the virtual machine and releases the compute resources
`Microsoft.Compute/virtualMachines/runCommand/action`	Executes a predefined script on the virtual machine
`Microsoft.Compute/virtualMachines/extensions/read`	Get the properties of a virtual machine extension
`Microsoft.Compute/virtualMachines/extensions/write`	Creates a new virtual machine extension or updates an existing one
`Microsoft.Compute/virtualMachines/extensions/delete`	Deletes the virtual machine extension
`Microsoft.Compute/virtualMachines/runCommands/read`	Get the properties of a virtual machine run command
`Microsoft.Compute/virtualMachines/runCommands/write`	Creates a new virtual machine run command or updates an existing one
`Microsoft.Compute/virtualMachines/vmSizes/read`	Lists available sizes the virtual machine can be updated to
`Microsoft.Network/networkSecurityGroups/read`	Gets a network security group definition
`Microsoft.Network/networkInterfaces/write`	Creates a network interface or updates an existing network interface.
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/networkInterfaces/join/action`	Joins a Virtual Machine to a network interface. Not Alertable.
`Microsoft.Network/networkInterfaces/delete`	Deletes a network interface
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.Network/virtualNetworks/usages/read`	Get the IP usages for each subnet of the virtual network
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Marketplace/offerTypes/publishers/offers/plans/agreements/read`	Returns an Agreement.
`Microsoft.KeyVault/vaults/deploy/action`	Enables access to secrets in a key vault when deploying Azure resources
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.DesktopVirtualization/scalingPlans/read`	Read scalingplans
`Microsoft.DesktopVirtualization/scalingPlans/write`	Write scalingplans

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Desktop Virtualization Virtual Machine Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Desktop Virtualization Virtual Machine Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'a959dbd1-f747-45e3-8ba6-dd80f235f97c')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a959dbd1-f747-45e3-8ba6-dd80f235f97c')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "a959dbd1-f747-45e3-8ba6-dd80f235f97c"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other compute roles

Compute Gallery Sharing Admin · 1 permission
Compute Gallery Image Reader · 2 permissions
Desktop Virtualization User · 2 permissions
Virtual Machine Local User Login · 2 permissions
Azure Batch Account Reader · 3 permissions
Disk Backup Reader · 3 permissions
Data Operator for Managed Disks · 4 permissions
Windows 365 Network User · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles