// roles/azure · compute

Windows Admin Center Administrator LoginAzure built-in role

Let's you manage the OS of your resource via Windows Admin Center as an administrator.

Role ID	`a6333a3e-0164-44c3-b281-7a577aff287f`
Category	Compute
Actions	41
Data actions	4

Before you assign it

It reaches the data, not just the resource. It has 4 data actions, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.HybridCompute/machines/*/read`	Any read operation on anything under Microsoft.HybridCompute/machines
`Microsoft.HybridCompute/machines/extensions/*`	Every operation under Microsoft.HybridCompute/machines/extensions
`Microsoft.HybridCompute/machines/upgradeExtensions/action`	Upgrades Extensions on Azure Arc machines
`Microsoft.HybridCompute/operations/read`	Read all Operations for Azure Arc for Servers
`Microsoft.Network/networkInterfaces/read`	Gets a network interface definition.
`Microsoft.Network/loadBalancers/read`	Gets a load balancer definition
`Microsoft.Network/publicIPAddresses/read`	Gets a public IP address definition.
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/networkSecurityGroups/read`	Gets a network security group definition
`Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read`	Gets a default security rule definition
`Microsoft.Network/networkWatchers/securityGroupView/action`	View the configured and effective network security group rules applied on a VM.
`Microsoft.Network/networkSecurityGroups/securityRules/read`	Gets a security rule definition
`Microsoft.Network/networkSecurityGroups/securityRules/write`	Creates a security rule or updates an existing security rule
`Microsoft.HybridConnectivity/endpoints/write`	Create or update the endpoint to the target resource.
`Microsoft.HybridConnectivity/endpoints/read`	List of endpoints to the target resource.
`Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write`	Create or update a service in serviceConfiguration for the endpoint resource.
`Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read`	API to enumerate registered services in service configurations under a Endpoint Resource
`Microsoft.HybridConnectivity/endpoints/listManagedProxyDetails/action`	Fetches the managed proxy details
`Microsoft.Compute/virtualMachines/read`	Get the properties of a virtual machine
`Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/read`	Retrieves the summary of the latest patch assessment operation
`Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/softwarePatches/read`	Retrieves list of patches assessed during the last patch assessment operation
`Microsoft.Compute/virtualMachines/patchInstallationResults/read`	Retrieves the summary of the latest patch installation operation
`Microsoft.Compute/virtualMachines/patchInstallationResults/softwarePatches/read`	Retrieves list of patches attempted to be installed during the last patch installation operation
`Microsoft.Compute/virtualMachines/extensions/read`	Get the properties of a virtual machine extension
`Microsoft.Compute/virtualMachines/instanceView/read`	Gets the detailed runtime status of the virtual machine and its resources
`Microsoft.Compute/virtualMachines/runCommands/read`	Get the properties of a virtual machine run command
`Microsoft.Compute/virtualMachines/vmSizes/read`	Lists available sizes the virtual machine can be updated to
`Microsoft.Compute/locations/publishers/artifacttypes/types/read`	Get the properties of a VMExtension Type
`Microsoft.Compute/locations/publishers/artifacttypes/types/versions/read`	Get the properties of a VMExtension Version
`Microsoft.Compute/diskAccesses/read`	Get the properties of DiskAccess resource
`Microsoft.Compute/galleries/images/read`	Gets the properties of Gallery Image
`Microsoft.Compute/images/read`	Get the properties of the Image
`Microsoft.AzureStackHCI/Clusters/Read`	Gets clusters
`Microsoft.AzureStackHCI/Clusters/ArcSettings/Read`	Gets Arc resource of Azure Local cluster
`Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Read`	Gets extension resource of HCI cluster
`Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Write`	Create or update extension resource of HCI cluster
`Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Delete`	Delete extension resources of Azure Local cluster
`Microsoft.AzureStackHCI/Operations/Read`	Gets operations
`Microsoft.ConnectedVMwarevSphere/VirtualMachines/Read`	Read virtualmachines
`Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Write`	Write extension resource
`Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Read`	Gets extension resource

Data actions

Permission	What it allows
`Microsoft.HybridCompute/machines/WACLoginAsAdmin/action`	Lets you manage the OS of your resource via Windows Admin Center as an administrator.
`Microsoft.Compute/virtualMachines/WACloginAsAdmin/action`	Lets you manage the OS of your resource via Windows Admin Center as an administrator
`Microsoft.AzureStackHCI/Clusters/WACloginAsAdmin/Action`	Manage OS of Azure Local resource via Windows Admin Center as an administrator
`Microsoft.ConnectedVMwarevSphere/virtualmachines/WACloginAsAdmin/action`	Lets you manage the OS of your resource via Windows Admin Center as an administrator.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Windows Admin Center Administrator Login" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Windows Admin Center Administrator Login" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'a6333a3e-0164-44c3-b281-7a577aff287f')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a6333a3e-0164-44c3-b281-7a577aff287f')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "a6333a3e-0164-44c3-b281-7a577aff287f"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other compute roles

Compute Gallery Sharing Admin · 1 permission
Compute Gallery Image Reader · 2 permissions
Desktop Virtualization User · 2 permissions
Virtual Machine Local User Login · 2 permissions
Azure Batch Account Reader · 3 permissions
Disk Backup Reader · 3 permissions
Data Operator for Managed Disks · 4 permissions
Windows 365 Network User · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles