Azure Hybrid + multicloud built-in role

Azure Arc ScVmm VM Contributor

Azure Arc ScVmm VM Contributor performs all projected SCVMM VM lifecycle actions, including create, update, delete, power, checkpoint, guest-agent, extension, patch, and run-command operations through Azure Arc-enabled SCVMM control-plane Actions. It has no DataActions, but its Azure operations can change the on-premises SCVMM resources projected through Azure Arc.

Control-plane actions (58)

• microsoft.scvmm/virtualmachines/*
• microsoft.scvmm/virtualMachineInstances/*
• Microsoft.Insights/AlertRules/Write
• Microsoft.Insights/AlertRules/Delete
• Microsoft.Insights/AlertRules/Read
• Microsoft.Insights/AlertRules/Activated/Action
• Microsoft.Insights/AlertRules/Resolved/Action
• Microsoft.Insights/AlertRules/Throttled/Action
• Microsoft.Insights/AlertRules/Incidents/Read
• Microsoft.Resources/deployments/read
• Microsoft.Resources/deployments/write
• Microsoft.Resources/deployments/delete
• Microsoft.Resources/deployments/cancel/action
• Microsoft.Resources/deployments/validate/action
• Microsoft.Resources/deployments/whatIf/action
• Microsoft.Resources/deployments/exportTemplate/action
• Microsoft.Resources/deployments/operations/read
• Microsoft.Resources/deployments/operationstatuses/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/write
• Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/subscriptions/operationresults/read
• Microsoft.ExtendedLocation/customLocations/Read
• Microsoft.ExtendedLocation/customLocations/deploy/action
• Microsoft.HybridCompute/machines/read
• Microsoft.HybridCompute/machines/write
• Microsoft.HybridCompute/machines/delete
• Microsoft.HybridCompute/machines/UpgradeExtensions/action
• Microsoft.HybridCompute/machines/assessPatches/action
• Microsoft.HybridCompute/machines/installPatches/action
• Microsoft.HybridCompute/machines/extensions/read
• Microsoft.HybridCompute/machines/extensions/write
• Microsoft.HybridCompute/machines/extensions/delete
• Microsoft.HybridCompute/operations/read
• Microsoft.HybridCompute/locations/operationresults/read
• Microsoft.HybridCompute/locations/operationstatus/read
• Microsoft.HybridCompute/machines/patchAssessmentResults/read
• Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read
• Microsoft.HybridCompute/machines/patchInstallationResults/read
• Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read
• Microsoft.HybridCompute/locations/updateCenterOperationResults/read
• Microsoft.HybridCompute/machines/hybridIdentityMetadata/read
• Microsoft.HybridCompute/osType/agentVersions/read
• Microsoft.HybridCompute/osType/agentVersions/latest/read
• Microsoft.HybridCompute/machines/runcommands/read
• Microsoft.HybridCompute/machines/runcommands/write
• Microsoft.HybridCompute/machines/runcommands/delete
• Microsoft.HybridCompute/machines/licenseProfiles/read
• Microsoft.HybridCompute/machines/licenseProfiles/write
• Microsoft.HybridCompute/machines/licenseProfiles/delete
• Microsoft.HybridCompute/licenses/read
• Microsoft.HybridCompute/licenses/write
• Microsoft.HybridCompute/licenses/delete

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the Azure subscription or resource group where the self-service VMs are deployed and managed. Pair it with Private Cloud User only on the approved SCVMM cloud, network, and template resources.

Common use cases (2)

• Let a self-service application team create, resize, attach disks and network interfaces, power-cycle, checkpoint, and delete its projected SCVMM VMs.
• Manage the Arc guest agent, extensions, patching, and run commands for the SCVMM VMs in an approved Azure resource group.

Prerequisites (2)

• The SCVMM management server must run a supported version, be connected to Azure Arc, and have a unique, running Azure Arc resource bridge and enabled inventory resources.
• An Owner or User Access Administrator at the target Azure scope is required to assign access; the SCVMM environment, network, static addresses, DNS, and bridge capacity must satisfy the onboarding requirements.

Best practices (2)

• Assign only on the SCVMM resources and Azure resource group required by the self-service workload; use a custom role for a smaller operation set.
• Keep the resource bridge online and supported, use groups for recurring access, and use eligible or time-bound assignments for elevated operations.

Security considerations (2)

• The role can delete or power off VMs, restore checkpoints, and use extensions or run commands that execute with privileged guest context, affecting workload integrity and availability.
• These are Azure control-plane permissions, but the resource bridge translates authorized Azure operations into changes on the private SCVMM environment; an inherited assignment can therefore affect more on-premises resources.

Assignment guidance

Assign Azure Arc ScVmm VM Contributor to the approved SCVMM operator or user group using the scope guidance above. Verify the resource bridge is healthy, test the intended operation, and remove or reduce access when the workflow ends.

Related roles (2)

• Azure Arc ScVmm Private Cloud User: Provides access to the selected SCVMM cloud, template, and network resources consumed during VM deployment.
• Azure Arc ScVmm Administrator role: Adds management-server, fabric, cloud, template, and network administration beyond VM lifecycle operations.

Editorial sources (9)

• Azure built-in roles for Hybrid + multicloud - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Azure built-in roles for Azure Arc-enabled SCVMM →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Set up and manage self-service access to SCVMM resources →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Quickstart: Connect your System Center Virtual Machine Manager management server to Azure Arc →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →