// roles/azure · compute

Virtual Machine Data Access Administrator (preview)Azure built-in role

Manage access to Virtual Machines by adding or removing role assignments for the Virtual Machine Administrator Login and Virtual Machine User Login roles. Includes an ABAC condition to constrain role assignments.

Role ID	`66f75aeb-eabe-4b70-9f1e-c350c4c9ad04`
Category	Compute
Actions	14
Data actions	0

Before you assign it

It can give access to others. It allows Microsoft.Authorization/roleAssignments/write, so treat it as a privileged role and assign it through PIM where you can.

What it can do

Permission	What it allows
`Microsoft.Authorization/roleAssignments/write`	Create a role assignment at the specified scope.
`Microsoft.Authorization/roleAssignments/delete`	Delete a role assignment at the specified scope.
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Management/managementGroups/read`	List management groups for the authenticated user.
`Microsoft.Network/publicIPAddresses/read`	Gets a public IP address definition.
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/loadBalancers/read`	Gets a load balancer definition
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Compute/virtualMachines/*/read`	Any read operation on anything under Microsoft.Compute/virtualMachines
`Microsoft.HybridCompute/machines/*/read`	Any read operation on anything under Microsoft.HybridCompute/machines
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Support/*`	Every operation under Microsoft.Support

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Virtual Machine Data Access Administrator (preview)" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Virtual Machine Data Access Administrator (preview)" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '66f75aeb-eabe-4b70-9f1e-c350c4c9ad04')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '66f75aeb-eabe-4b70-9f1e-c350c4c9ad04')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "66f75aeb-eabe-4b70-9f1e-c350c4c9ad04"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other compute roles

Compute Gallery Sharing Admin · 1 permission
Compute Gallery Image Reader · 2 permissions
Desktop Virtualization User · 2 permissions
Virtual Machine Local User Login · 2 permissions
Azure Batch Account Reader · 3 permissions
Disk Backup Reader · 3 permissions
Data Operator for Managed Disks · 4 permissions
Windows 365 Network User · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles