// roles/azure · management-and-governance

Essential Machine Management AdministratorAzure built-in role

Can managed Essential Machine Management resources for subscriptions

Role ID	`34013b0a-565b-43aa-8755-1b7c286f6cf7`
Category	Management-and-governance
Actions	19
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Insights/dataCollectionRules/read`	Read a data collection rule
`Microsoft.Insights/dataCollectionRules/write`	Create or update a data collection rule
`Microsoft.Monitor/accounts/write`	Create or Update any Monitoring Account
`Microsoft.Monitor/accounts/read`	Read any Monitoring Account
`Microsoft.ManagedOps/managedOps/read`	Gets the information of the ManagedOps instance.
`Microsoft.ManagedOps/managedOps/write`	Updates the ManagedOps instance with the supplied fields.
`Microsoft.ManagedOps/managedOps/delete`	Deletes the ManagedOps instance.
`Microsoft.OperationsManagement/solutions/read`	Get existing OMS solution
`Microsoft.OperationsManagement/solutions/write`	Create new OMS solution
`Microsoft.OperationalInsights/workspaces/read`	Gets an existing workspace
`Microsoft.OperationalInsights/workspaces/sharedkeys/action`	Retrieves the shared keys for the workspace. These keys are used to connect Microsoft Operational Insights agents to the workspace.
`Microsoft.OperationalInsights/workspaces/sharedkeys/read`	Retrieves the shared keys for the workspace. These keys are used to connect Microsoft Operational Insights agents to the workspace.
`Microsoft.OperationalInsights/workspaces/listKeys/action`	Retrieves the list keys for the workspace. These keys are used to connect Microsoft Operational Insights agents to the workspace.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Insights/metricAlerts/write`	Create or update a metric alert
`Microsoft.Insights/metricAlerts/read`	Read a metric alert
`Microsoft.Security/pricings/write`	Updates the pricing settings for the scope
`Microsoft.Security/pricings/read`	Gets the pricing settings for the scope

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Essential Machine Management Administrator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Essential Machine Management Administrator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '34013b0a-565b-43aa-8755-1b7c286f6cf7')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '34013b0a-565b-43aa-8755-1b7c286f6cf7')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "34013b0a-565b-43aa-8755-1b7c286f6cf7"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other management-and-governance roles

Service Group Contributor · 1 permission
Template Spec Reader · 1 permission
Carbon Optimization Reader · 2 permissions
Hierarchy Settings Administrator · 2 permissions
Reservations Reader · 2 permissions
Service Group Reader · 2 permissions
Advisor Reviews Reader · 3 permissions
Managed Application Operator Role · 3 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles