Azure Compute built-in role

Desktop Virtualization Power On Off Contributor

Allows the Azure Virtual Desktop resource provider to start, stop, restart, deallocate, or hibernate session-host compute and to perform the host-pool and user-session actions needed by scaling plans. This is a service-agent role, not a general human VM contributor role.

Control-plane actions (37)

• Microsoft.Authorization/*/read
• Microsoft.AzureStackHCI/operations/read
• Microsoft.AzureStackHCI/virtualMachineInstances/read
• Microsoft.AzureStackHCI/virtualMachineInstances/restart/action
• Microsoft.AzureStackHCI/virtualMachineInstances/start/action
• Microsoft.AzureStackHCI/virtualMachineInstances/stop/action
• Microsoft.Compute/virtualMachines/deallocate/action
• Microsoft.Compute/virtualMachines/instanceView/read
• Microsoft.Compute/virtualMachines/powerOff/action
• Microsoft.Compute/virtualMachines/read
• Microsoft.Compute/virtualMachines/restart/action
• Microsoft.Compute/virtualMachines/start/action
• Microsoft.ComputeSchedule/locations/virtualMachinesCancelOperations/action
• Microsoft.ComputeSchedule/locations/virtualMachinesExecuteDeallocate/action
• Microsoft.ComputeSchedule/locations/virtualMachinesExecuteHibernate/action
• Microsoft.ComputeSchedule/locations/virtualMachinesExecuteStart/action
• Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationErrors/action
• Microsoft.ComputeSchedule/locations/virtualMachinesGetOperationStatus/action
• Microsoft.ComputeSchedule/locations/virtualMachinesSubmitDeallocate/action
• Microsoft.ComputeSchedule/locations/virtualMachinesSubmitHibernate/action
• Microsoft.ComputeSchedule/locations/virtualMachinesSubmitStart/action
• Microsoft.ComputeSchedule/register/action
• Microsoft.DesktopVirtualization/hostpools/read
• Microsoft.DesktopVirtualization/hostpools/sessionhosts/read
• Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/delete
• Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/read
• Microsoft.DesktopVirtualization/hostpools/sessionhosts/usersessions/sendMessage/action
• Microsoft.DesktopVirtualization/hostpools/sessionhosts/write
• Microsoft.DesktopVirtualization/hostpools/write
• Microsoft.HybridCompute/locations/operationresults/read
• Microsoft.HybridCompute/locations/operationstatus/read
• Microsoft.HybridCompute/machines/read
• Microsoft.HybridCompute/operations/read
• Microsoft.Insights/alertRules/*
• Microsoft.Insights/eventtypes/values/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign to the Azure Virtual Desktop service principal at every subscription containing host pools and session hosts managed by autoscale. Microsoft states that assignment below subscription scope prevents autoscale from working properly. Permissions are control-plane Actions only and include power, host-pool, and session operations; there are no DataActions.

Common use cases (2)

• Enable Azure Virtual Desktop autoscale to start, stop, restart, deallocate, or hibernate session hosts.
• Let the service drain or update session-host state and notify or sign out user sessions as part of a scaling workflow.

Prerequisites (2)

• Create and configure the Azure Virtual Desktop scaling plan and identify the Azure Virtual Desktop service principal.
• The administrator assigning the service role needs Microsoft.Authorization/roleAssignments/write on each affected subscription, such as through User Access Administrator or Owner.

Best practices (3)

• Assign only to the Azure Virtual Desktop service principal and only for subscriptions managed by the scaling plan.
• Use scaling schedules, load-balancing settings, drain behavior, and user notifications that match workload and session requirements.
• Monitor power actions, session logoffs, and compute cost, and remove stale service assignments.

Security considerations (3)

• The service can stop or deallocate session hosts and can delete user sessions, which can interrupt work or cause data loss in unsaved sessions.
• The role can register Microsoft.ComputeSchedule and submit scheduled power operations across its inherited scope.
• It has no guest-login DataActions, but its power and session-control authority is operationally privileged.

Assignment guidance

Assign Desktop Virtualization Power On Off Contributor to the Azure Virtual Desktop service principal at each subscription used by an autoscale scaling plan. Do not assign it below subscription scope or to ordinary users, and remove it when scaling-plan control is retired.

Editorial sources (6)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Built-in Azure RBAC roles for Azure Virtual Desktop →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.

• Create and assign an autoscale scaling plan for Azure Virtual Desktop →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →