// roles/azure · compute

Virtual Machine ContributorAzure built-in role

Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected to.

Role ID	`9980e02c-c2be-4d73-94e8-173b1dc7cf3c`
Category	Compute
Actions	45
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Compute/availabilitySets/*`	Every operation under Microsoft.Compute/availabilitySets
`Microsoft.Compute/locations/*`	Every operation under Microsoft.Compute/locations
`Microsoft.Compute/virtualMachines/*`	Every operation under Microsoft.Compute/virtualMachines
`Microsoft.Compute/virtualMachineScaleSets/*`	Every operation under Microsoft.Compute/virtualMachineScaleSets
`Microsoft.Compute/cloudServices/*`	Every operation under Microsoft.Compute/cloudServices
`Microsoft.Compute/disks/write`	Creates a new Disk or updates an existing one
`Microsoft.Compute/disks/read`	Get the properties of a Disk
`Microsoft.Compute/disks/delete`	Deletes the Disk
`Microsoft.Compute/hostgroups/write`	Creates a new host group or updates an existing host group
`Microsoft.Compute/hostgroups/hosts/write`	Creates a new host or updates an existing host
`Microsoft.DevTestLab/schedules/*`	Every operation under Microsoft.DevTestLab/schedules
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Network/applicationGateways/backendAddressPools/join/action`	Joins an application gateway backend address pool. Not Alertable.
`Microsoft.Network/loadBalancers/backendAddressPools/join/action`	Joins a load balancer backend address pool. Not Alertable.
`Microsoft.Network/loadBalancers/inboundNatPools/join/action`	Joins a load balancer inbound NAT pool. Not alertable.
`Microsoft.Network/loadBalancers/inboundNatRules/join/action`	Joins a load balancer inbound nat rule. Not Alertable.
`Microsoft.Network/loadBalancers/probes/join/action`	Allows using probes of a load balancer. For example, with this permission healthProbe property of VM scale set can reference the probe. Not alertable.
`Microsoft.Network/loadBalancers/read`	Gets a load balancer definition
`Microsoft.Network/locations/*`	Every operation under Microsoft.Network/locations
`Microsoft.Network/networkInterfaces/*`	Every operation under Microsoft.Network/networkInterfaces
`Microsoft.Network/networkSecurityGroups/join/action`	Joins a network security group. Not Alertable.
`Microsoft.Network/networkSecurityGroups/read`	Gets a network security group definition
`Microsoft.Network/publicIPAddresses/join/action`	Joins a public IP address. Not Alertable.
`Microsoft.Network/publicIPAddresses/read`	Gets a public IP address definition.
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/virtualNetworks/subnets/join/action`	Joins a virtual network. Not Alertable.
`Microsoft.RecoveryServices/locations/*`	Every operation under Microsoft.RecoveryServices/locations
`Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write`	Create a backup Protection Intent
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/*/read`	Any read operation on anything under Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read`	Returns object details of the Protected Item
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write`	Create a backup Protected Item
`Microsoft.RecoveryServices/Vaults/backupPolicies/read`	Returns all Protection Policies
`Microsoft.RecoveryServices/Vaults/backupPolicies/write`	Creates or Updates Protection Policy
`Microsoft.RecoveryServices/Vaults/read`	The Get Vault operation gets an object representing the Azure resource of type 'vault'
`Microsoft.RecoveryServices/Vaults/usages/read`	Returns usage details for a Recovery Services Vault.
`Microsoft.RecoveryServices/Vaults/write`	Create Vault operation creates an Azure resource of type 'vault'
`Microsoft.ResourceHealth/availabilityStatuses/read`	Gets the availability statuses for all resources in the specified scope
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.SerialConsole/serialPorts/connect/action`
`Microsoft.SqlVirtualMachine/*`	Every operation under Microsoft.SqlVirtualMachine
`Microsoft.Storage/storageAccounts/listKeys/action`	Returns the access keys for the specified storage account.
`Microsoft.Storage/storageAccounts/read`	Returns the list of storage accounts or gets the properties for the specified storage account.
`Microsoft.Support/*`	Every operation under Microsoft.Support

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Virtual Machine Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Virtual Machine Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "9980e02c-c2be-4d73-94e8-173b1dc7cf3c"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other compute roles

Compute Gallery Sharing Admin · 1 permission
Compute Gallery Image Reader · 2 permissions
Desktop Virtualization User · 2 permissions
Virtual Machine Local User Login · 2 permissions
Azure Batch Account Reader · 3 permissions
Disk Backup Reader · 3 permissions
Data Operator for Managed Disks · 4 permissions
Windows 365 Network User · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles