Azure Compute built-in role

Desktop Virtualization Power On Off Contributor

Allows the Azure Virtual Desktop resource provider to start, stop, restart, deallocate, or hibernate session-host compute and to perform the host-pool and user-session actions needed by scaling plans. This is a service-agent role, not a general human VM contributor role.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 40c5ff49-9181-41f8-ae61-143b0e78555e

Control-plane actions (37)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign to the Azure Virtual Desktop service principal at every subscription containing host pools and session hosts managed by autoscale. Microsoft states that assignment below subscription scope prevents autoscale from working properly. Permissions are control-plane Actions only and include power, host-pool, and session operations; there are no DataActions.

Common use cases (2)

Prerequisites (2)

Best practices (3)

Security considerations (3)

Assignment guidance

Assign Desktop Virtualization Power On Off Contributor to the Azure Virtual Desktop service principal at each subscription used by an autoscale scaling plan. Do not assign it below subscription scope or to ordinary users, and remove it when scaling-plan control is retired.

Common questions

When should I assign the Desktop Virtualization Power On Off Contributor Azure role?

Assign Desktop Virtualization Power On Off Contributor when you need to: Enable Azure Virtual Desktop autoscale to start, stop, restart, deallocate, or hibernate session hosts.; and Let the service drain or update session-host state and notify or sign out user sessions as part of a scaling workflow.. Practical scope: Assign to the Azure Virtual Desktop service principal at every subscription containing host pools and session hosts managed by autoscale. Microsoft states that assignment below subscription scope prevents autoscale from working properly. Permissions are control-plane Actions only and include power, host-pool, and session operations; there are no DataActions.

What permissions does the Desktop Virtualization Power On Off Contributor Azure role grant?

The role definition grants 37 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.AzureStackHCI/operations/read; Microsoft.AzureStackHCI/virtualMachineInstances/read; Microsoft.AzureStackHCI/virtualMachineInstances/restart/action; Microsoft.AzureStackHCI/virtualMachineInstances/start/action; and Microsoft.AzureStackHCI/virtualMachineInstances/stop/action. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Desktop Virtualization Power On Off Contributor Azure role?

Key considerations when assigning Desktop Virtualization Power On Off Contributor: The service can stop or deallocate session hosts and can delete user sessions, which can interrupt work or cause data loss in unsaved sessions.; The role can register Microsoft.ComputeSchedule and submit scheduled power operations across its inherited scope.; and It has no guest-login DataActions, but its power and session-control authority is operationally privileged.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (6)

Official Microsoft Learn documentation →