Azure Hybrid + multicloud built-in role

Azure Arc ScVmm Administrator role

Azure Arc ScVmm Administrator role performs all SCVMM actions and manages projected machines, extensions, run commands, patching, licenses, templates, networks, clouds, and management servers through Azure Arc-enabled SCVMM control-plane Actions. It has no DataActions, but its Azure operations can change the on-premises SCVMM resources projected through Azure Arc.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: a92dfd61-77f9-4aec-a531-19858b406c87

Control-plane actions (57)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on the resource group containing the Arc-enabled SCVMM management server and projected inventory. A broader assignment inherits complete SCVMM and Hybrid Compute administration to additional environments.

Common use cases (2)

Prerequisites (2)

Best practices (2)

Security considerations (2)

Assignment guidance

Assign Azure Arc ScVmm Administrator role to the approved SCVMM operator or user group using the scope guidance above. Verify the resource bridge is healthy, test the intended operation, and remove or reduce access when the workflow ends.

Related roles (3)

Common questions

When should I assign the Azure Arc ScVmm Administrator role Azure role?

Assign Azure Arc ScVmm Administrator role when you need to: Administer the complete Arc-enabled SCVMM environment, including management servers, inventory, clouds, templates, networks, VMs, extensions, patching, and run commands.; and Troubleshoot or reconcile an enabled SCVMM VM when the operator needs both SCVMM and Arc-enabled server administration.. Practical scope: Assign on the resource group containing the Arc-enabled SCVMM management server and projected inventory. A broader assignment inherits complete SCVMM and Hybrid Compute administration to additional environments.

What permissions does the Azure Arc ScVmm Administrator role Azure role grant?

The role definition grants 57 combined control-plane and data-plane actions. Representative operations include: Microsoft.ScVmm/*; Microsoft.Insights/AlertRules/Write; Microsoft.Insights/AlertRules/Delete; Microsoft.Insights/AlertRules/Read; Microsoft.Insights/AlertRules/Activated/Action; and Microsoft.Insights/AlertRules/Resolved/Action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Azure Arc ScVmm Administrator role Azure role?

Key considerations when assigning Azure Arc ScVmm Administrator role: The role can delete VMs and management resources, run commands and extensions that execute with privileged guest context, change patch and license state, and alter the SCVMM fabric exposed through Azure.; and These are Azure control-plane permissions, but the resource bridge translates authorized Azure operations into changes on the private SCVMM environment; an inherited assignment can therefore affect more on-premises resources.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (9)

Official Microsoft Learn documentation →