Azure Compute built-in role
Desktop Virtualization Power On Contributor
Allows the Azure Virtual Desktop resource provider to read and start session-host virtual machines for Start VM on Connect. The current workflow documents session hosts on Azure and Azure Local; it does not document Azure Arc-enabled servers as a Start VM on Connect platform.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 489581de-a3bd-480d-9518-53dea7416b33
Control-plane actions (14)
Microsoft.Compute/virtualMachines/start/actionMicrosoft.Compute/virtualMachines/readMicrosoft.Compute/virtualMachines/instanceView/readMicrosoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.HybridCompute/machines/readMicrosoft.HybridCompute/operations/readMicrosoft.HybridCompute/locations/operationresults/readMicrosoft.HybridCompute/locations/operationstatus/readMicrosoft.AzureStackHCI/virtualMachineInstances/readMicrosoft.AzureStackHCI/virtualMachineInstances/start/actionMicrosoft.AzureStackHCI/operations/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign to the Azure Virtual Desktop service principal at each subscription that contains host pools and session-host VMs using Start VM on Connect. Microsoft states that assignment below subscription scope prevents the feature from working properly. The role has no DataActions or guest-login rights.
Common use cases (2)
- Enable Azure Virtual Desktop start-on-connect so a deallocated session host can start when a user connects.
- Allow the service to start approved session-host VM instances without general VM update or delete authority.
Prerequisites (2)
- Use an existing host pool associated with an application group and workspace, and identify the Azure Virtual Desktop service principal.
- The administrator enabling Start VM on Connect needs Desktop Virtualization Host Pool Contributor and role-assignment authority on each affected subscription.
Best practices (3)
- Assign this role to the Azure Virtual Desktop service principal, not to end users or general administrators.
- Use a dedicated subscription boundary when unrelated VMs must not inherit the service principal's start authority; a lower assignment scope is not supported for this feature.
- Monitor automated starts and remove the assignment when the feature is disabled or the host pool is retired.
Security considerations (3)
- The service can start every compatible VM in the inherited assignment scope, which can create cost and availability impact.
- The role cannot stop, delete, reconfigure, or sign in to VMs and has no DataActions.
- Assigning it to a human does not provide a complete VM operations role and obscures its intended service-agent boundary.
Assignment guidance
Assign Desktop Virtualization Power On Contributor to the Azure Virtual Desktop service principal at every subscription containing host pools and session hosts that use Start VM on Connect. Do not assign it below subscription scope or use it as a human operator role.
Common questions
When should I assign the Desktop Virtualization Power On Contributor Azure role?
Assign Desktop Virtualization Power On Contributor when you need to: Enable Azure Virtual Desktop start-on-connect so a deallocated session host can start when a user connects.; and Allow the service to start approved session-host VM instances without general VM update or delete authority.. Practical scope: Assign to the Azure Virtual Desktop service principal at each subscription that contains host pools and session-host VMs using Start VM on Connect. Microsoft states that assignment below subscription scope prevents the feature from working properly. The role has no DataActions or guest-login rights.
What permissions does the Desktop Virtualization Power On Contributor Azure role grant?
The role definition grants 14 combined control-plane and data-plane actions. Representative operations include: Microsoft.Compute/virtualMachines/start/action; Microsoft.Compute/virtualMachines/read; Microsoft.Compute/virtualMachines/instanceView/read; Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; and Microsoft.Resources/deployments/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Desktop Virtualization Power On Contributor Azure role?
Key considerations when assigning Desktop Virtualization Power On Contributor: The service can start every compatible VM in the inherited assignment scope, which can create cost and availability impact.; The role cannot stop, delete, reconfigure, or sign in to VMs and has no DataActions.; and Assigning it to a human does not provide a complete VM operations role and obscures its intended service-agent boundary.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Built-in Azure RBAC roles for Azure Virtual Desktop →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Configure Start VM on Connect for Azure Virtual Desktop →
Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.