Azure Management and governance built-in role
Azure Connected Machine Resource Administrator
Manages Azure Arc-enabled servers after onboarding, including machine lifecycle, re-onboarding, deletion, extensions, run commands, licenses, gateways, settings, and private link scopes. It is control-plane only, but extensions and run commands can execute privileged code on the connected server.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: cd570a14-e51a-42ad-bac8-bafd67325302
Control-plane actions (12)
Microsoft.HybridCompute/machines/*Microsoft.HybridCompute/machines/extensions/*Microsoft.HybridCompute/machines/licenseProfiles/*Microsoft.HybridCompute/machines/runCommands/*Microsoft.HybridCompute/machines/UpgradeExtensions/actionMicrosoft.HybridCompute/settings/*Microsoft.HybridCompute/gateways/*Microsoft.HybridCompute/privateLinkScopes/*Microsoft.HybridCompute/licenses/*Microsoft.HybridCompute/locations/*Microsoft.HybridCompute/*/readMicrosoft.Resources/deployments/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign at the individual Arc machine or dedicated resource group. A subscription or management-group assignment grants machine administration across every inherited Arc-enabled server.
Common use cases (2)
- Administer the Azure resource lifecycle and configuration of connected servers after onboarding.
- Deploy and manage approved VM extensions, run commands, licenses, connectivity, and private-link configuration for an Arc server fleet.
Prerequisites (2)
- Servers must already be connected to Azure Arc or require an approved re-onboarding operation.
- Define extension allowlists, run-command controls, local administrator ownership, and logging before delegation.
Best practices (2)
- Use Onboarding for registration-only identities and reserve Resource Administrator for trusted server administrators.
- Scope to a machine or dedicated resource group, use eligible access for people, and monitor extension and run-command activity.
Security considerations (2)
- Microsoft warns that extension deployment can run arbitrary scripts in a privileged context and can effectively provide root or local administrator access.
- The role can delete or re-onboard machines and change connectivity and license state, so no DataActions does not make it low risk.
Assignment guidance
Assign only to trusted Arc server administrators at the machine or dedicated resource-group scope. Use Onboarding for enrollment identities and narrower Run Command roles where only command execution is needed.
Related roles (1)
- Azure Connected Machine Onboarding: Narrower registration-only role that cannot delete servers or manage extensions.
Common questions
When should I assign the Azure Connected Machine Resource Administrator Azure role?
Assign Azure Connected Machine Resource Administrator when you need to: Administer the Azure resource lifecycle and configuration of connected servers after onboarding.; and Deploy and manage approved VM extensions, run commands, licenses, connectivity, and private-link configuration for an Arc server fleet.. Practical scope: Azure RBAC assignments apply at the selected scope and are inherited by child scopes. Keep the assignment at the narrowest resource, resource group, subscription, or management-group boundary that contains the intended resources. Assign at the individual Arc machine or dedicated resource group. A subscription or management-group assignment grants machine administration across every inherited Arc-enabled server.
What permissions does the Azure Connected Machine Resource Administrator Azure role grant?
The role definition grants 12 combined control-plane and data-plane actions. Representative operations include: Microsoft.HybridCompute/machines/*; Microsoft.HybridCompute/machines/extensions/*; Microsoft.HybridCompute/machines/licenseProfiles/*; Microsoft.HybridCompute/machines/runCommands/*; Microsoft.HybridCompute/machines/UpgradeExtensions/action; and Microsoft.HybridCompute/settings/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Connected Machine Resource Administrator Azure role?
Key considerations when assigning Azure Connected Machine Resource Administrator: Microsoft warns that extension deployment can run arbitrary scripts in a privileged context and can effectively provide root or local administrator access.; and The role can delete or re-onboard machines and change connectivity and license state, so no DataActions does not make it low risk.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Identity and authorization for Azure Arc-enabled servers →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Planning and deployment guidance for Azure Arc-enabled servers →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.