azureblog.co.uk
← cd ~/roles
// roles/azure · migration

Migrate Arc Discovery Reader - PreviewAzure built-in role

Read metadata of Azure Arc enabled server resources and metadata, performance and migration suitability of Arc enabled SQL server resources. Users creating Azure Migrate project that uses Arc resource discovery require this role on Arc scope of the project. To enable periodic sync, Azure Migrate project managed identity must be assigned this role. This role is in preview and subject to change.

Role ID5d5dddae-e124-4753-972d-aae60b37deb4
CategoryMigration
Actions8
Data actions0

What it can do

PermissionWhat it allows
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.
Microsoft.AzureArcData/sqlServerInstances/read
Microsoft.AzureArcData/sqlServerInstances/databases/read
Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/read
Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action
Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action
Microsoft.HybridCompute/machines/readRead any Azure Arc machines
Microsoft.HybridCompute/machines/extensions/readReads any Azure Arc extensions

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Migrate Arc Discovery Reader - Preview" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Migrate Arc Discovery Reader - Preview" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '5d5dddae-e124-4753-972d-aae60b37deb4')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5d5dddae-e124-4753-972d-aae60b37deb4')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "5d5dddae-e124-4753-972d-aae60b37deb4"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other migration roles

Find the smallest role for a task →

Sources