Azure Hybrid + multicloud built-in role

Azure Arc ScVmm Private Cloud User

Azure Arc ScVmm Private Cloud User uses selected SCVMM clouds, VM templates, and VM networks to deploy VMs without general SCVMM administration through Azure Arc-enabled SCVMM control-plane Actions. It has no DataActions, but its Azure operations can change the on-premises SCVMM resources projected through Azure Arc.

Control-plane actions (34)

• Microsoft.Insights/AlertRules/Write
• Microsoft.Insights/AlertRules/Delete
• Microsoft.Insights/AlertRules/Read
• Microsoft.Insights/AlertRules/Activated/Action
• Microsoft.Insights/AlertRules/Resolved/Action
• Microsoft.Insights/AlertRules/Throttled/Action
• Microsoft.Insights/AlertRules/Incidents/Read
• Microsoft.Resources/deployments/read
• Microsoft.Resources/deployments/write
• Microsoft.Resources/deployments/delete
• Microsoft.Resources/deployments/cancel/action
• Microsoft.Resources/deployments/validate/action
• Microsoft.Resources/deployments/whatIf/action
• Microsoft.Resources/deployments/exportTemplate/action
• Microsoft.Resources/deployments/operations/read
• Microsoft.Resources/deployments/operationstatuses/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/write
• Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/subscriptions/operationresults/read
• microsoft.scvmm/virtualnetworks/join/action
• microsoft.scvmm/virtualnetworks/Read
• microsoft.scvmm/virtualmachinetemplates/clone/action
• microsoft.scvmm/virtualmachinetemplates/Read
• microsoft.scvmm/clouds/deploy/action
• microsoft.scvmm/clouds/Read
• Microsoft.ExtendedLocation/customLocations/Read
• Microsoft.ExtendedLocation/customLocations/deploy/action
• Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign separately on each Arc-enabled SCVMM cloud, VM template, and VM network the user may consume, or on a resource group containing exactly those resources. The user also needs VM Contributor on the Azure resource group where VMs are deployed.

Common use cases (2)

• Give an application team self-service access to clone approved VM templates, join approved VM networks, and deploy into an approved SCVMM private cloud.
• Partition a shared SCVMM environment by assigning different user groups to different cloud, network, and template resource sets.

Prerequisites (2)

• The SCVMM management server must run a supported version, be connected to Azure Arc, and have a unique, running Azure Arc resource bridge and enabled inventory resources.
• An Owner or User Access Administrator at the target Azure scope is required to assign access; the SCVMM environment, network, static addresses, DNS, and bridge capacity must satisfy the onboarding requirements.

Best practices (2)

• Assign only on the SCVMM resources and Azure resource group required by the self-service workload; use a custom role for a smaller operation set.
• Keep the resource bridge online and supported, use groups for recurring access, and use eligible or time-bound assignments for elevated operations.

Security considerations (2)

• The role can consume cloud capacity, clone templates, join networks, and create Azure deployments on every SCVMM resource in its assignment scope.
• These are Azure control-plane permissions, but the resource bridge translates authorized Azure operations into changes on the private SCVMM environment; an inherited assignment can therefore affect more on-premises resources.

Assignment guidance

Assign Azure Arc ScVmm Private Cloud User to the approved SCVMM operator or user group using the scope guidance above. Verify the resource bridge is healthy, test the intended operation, and remove or reduce access when the workflow ends.

Related roles (2)

• Azure Arc ScVmm VM Contributor: Supplies the separate Azure resource-group permission needed to create and manage the deployed VMs.
• Azure Arc ScVmm Administrator role: Adds full SCVMM fabric and Arc machine administration.

Editorial sources (9)

• Azure built-in roles for Hybrid + multicloud - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Azure built-in roles for Azure Arc-enabled SCVMM →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Set up and manage self-service access to SCVMM resources →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Quickstart: Connect your System Center Virtual Machine Manager management server to Azure Arc →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →