Azure Compute built-in role

Desktop Virtualization Power On Contributor

Allows the Azure Virtual Desktop resource provider to read and start session-host virtual machines for Start VM on Connect. The current workflow documents session hosts on Azure and Azure Local; it does not document Azure Arc-enabled servers as a Start VM on Connect platform.

Control-plane actions (14)

• Microsoft.Compute/virtualMachines/start/action
• Microsoft.Compute/virtualMachines/read
• Microsoft.Compute/virtualMachines/instanceView/read
• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.HybridCompute/machines/read
• Microsoft.HybridCompute/operations/read
• Microsoft.HybridCompute/locations/operationresults/read
• Microsoft.HybridCompute/locations/operationstatus/read
• Microsoft.AzureStackHCI/virtualMachineInstances/read
• Microsoft.AzureStackHCI/virtualMachineInstances/start/action
• Microsoft.AzureStackHCI/operations/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign to the Azure Virtual Desktop service principal at each subscription that contains host pools and session-host VMs using Start VM on Connect. Microsoft states that assignment below subscription scope prevents the feature from working properly. The role has no DataActions or guest-login rights.

Common use cases (2)

• Enable Azure Virtual Desktop start-on-connect so a deallocated session host can start when a user connects.
• Allow the service to start approved session-host VM instances without general VM update or delete authority.

Prerequisites (2)

• Use an existing host pool associated with an application group and workspace, and identify the Azure Virtual Desktop service principal.
• The administrator enabling Start VM on Connect needs Desktop Virtualization Host Pool Contributor and role-assignment authority on each affected subscription.

Best practices (3)

• Assign this role to the Azure Virtual Desktop service principal, not to end users or general administrators.
• Use a dedicated subscription boundary when unrelated VMs must not inherit the service principal's start authority; a lower assignment scope is not supported for this feature.
• Monitor automated starts and remove the assignment when the feature is disabled or the host pool is retired.

Security considerations (3)

• The service can start every compatible VM in the inherited assignment scope, which can create cost and availability impact.
• The role cannot stop, delete, reconfigure, or sign in to VMs and has no DataActions.
• Assigning it to a human does not provide a complete VM operations role and obscures its intended service-agent boundary.

Assignment guidance

Assign Desktop Virtualization Power On Contributor to the Azure Virtual Desktop service principal at every subscription containing host pools and session hosts that use Start VM on Connect. Do not assign it below subscription scope or use it as a human operator role.

Editorial sources (6)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Built-in Azure RBAC roles for Azure Virtual Desktop →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Configure Start VM on Connect for Azure Virtual Desktop →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →