Azure Management and governance built-in role

Azure Connected Machine Resource Administrator

Manages Azure Arc-enabled servers after onboarding, including machine lifecycle, re-onboarding, deletion, extensions, run commands, licenses, gateways, settings, and private link scopes. It is control-plane only, but extensions and run commands can execute privileged code on the connected server.

Control-plane actions (12)

• Microsoft.HybridCompute/machines/*
• Microsoft.HybridCompute/machines/extensions/*
• Microsoft.HybridCompute/machines/licenseProfiles/*
• Microsoft.HybridCompute/machines/runCommands/*
• Microsoft.HybridCompute/machines/UpgradeExtensions/action
• Microsoft.HybridCompute/settings/*
• Microsoft.HybridCompute/gateways/*
• Microsoft.HybridCompute/privateLinkScopes/*
• Microsoft.HybridCompute/licenses/*
• Microsoft.HybridCompute/locations/*
• Microsoft.HybridCompute/*/read
• Microsoft.Resources/deployments/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign at the individual Arc machine or dedicated resource group. A subscription or management-group assignment grants machine administration across every inherited Arc-enabled server.

Common use cases (2)

• Administer the Azure resource lifecycle and configuration of connected servers after onboarding.
• Deploy and manage approved VM extensions, run commands, licenses, connectivity, and private-link configuration for an Arc server fleet.

Prerequisites (2)

• Servers must already be connected to Azure Arc or require an approved re-onboarding operation.
• Define extension allowlists, run-command controls, local administrator ownership, and logging before delegation.

Best practices (2)

• Use Onboarding for registration-only identities and reserve Resource Administrator for trusted server administrators.
• Scope to a machine or dedicated resource group, use eligible access for people, and monitor extension and run-command activity.

Security considerations (2)

• Microsoft warns that extension deployment can run arbitrary scripts in a privileged context and can effectively provide root or local administrator access.
• The role can delete or re-onboard machines and change connectivity and license state, so no DataActions does not make it low risk.

Assignment guidance

Assign only to trusted Arc server administrators at the machine or dedicated resource-group scope. Use Onboarding for enrollment identities and narrower Run Command roles where only command execution is needed.

Related roles (1)

• Azure Connected Machine Onboarding: Narrower registration-only role that cannot delete servers or manage extensions.

Editorial sources (6)

• Azure built-in roles for Management and governance →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Identity and authorization for Azure Arc-enabled servers →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Planning and deployment guidance for Azure Arc-enabled servers →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →