Azure Management and governance built-in role
Essential Machine Management Administrator
Enables and manages Essential machine management preview enrollment for subscriptions, including ManagedOps, monitoring resources, data collection rules, deployments, policy-related configuration, and Log Analytics workspace shared-key retrieval. It is a broad control-plane role with no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 34013b0a-565b-43aa-8755-1b7c286f6cf7
Control-plane actions (19)
Microsoft.Resources/deployments/*Microsoft.Insights/dataCollectionRules/readMicrosoft.Insights/dataCollectionRules/writeMicrosoft.Monitor/accounts/writeMicrosoft.Monitor/accounts/readMicrosoft.ManagedOps/managedOps/readMicrosoft.ManagedOps/managedOps/writeMicrosoft.ManagedOps/managedOps/deleteMicrosoft.OperationsManagement/solutions/readMicrosoft.OperationsManagement/solutions/writeMicrosoft.OperationalInsights/workspaces/readMicrosoft.OperationalInsights/workspaces/sharedkeys/actionMicrosoft.OperationalInsights/workspaces/sharedkeys/readMicrosoft.OperationalInsights/workspaces/listKeys/actionMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Insights/metricAlerts/writeMicrosoft.Insights/metricAlerts/readMicrosoft.Security/pricings/writeMicrosoft.Security/pricings/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft requires the role on the subscription being enabled and, when monitoring workspaces are in another subscription, on the resource groups containing those workspaces. Parent assignments inherit and can expose workspace keys and management configuration beyond one enrollment.
Common use cases (2)
- Enable or disable preview Essential machine management for a subscription so Azure VMs and Arc-enabled servers receive curated monitoring, security, and management configuration.
- Select and manage the Log Analytics workspace, Azure Monitor workspace, and user-assigned identity used by subscription enrollment.
Prerequisites (2)
- Create the required Log Analytics workspace, Azure Monitor workspace, and user-assigned managed identity.
- The enrolling user also needs Managed Identity Operator and Resource Policy Contributor; register Microsoft.ManagedOps in any separate workspace subscription.
Best practices (2)
- Treat the feature as preview, test in a nonproduction subscription, and document the monitoring and security configuration it applies automatically.
- Assign only during enrollment administration, protect workspace shared keys, and use eligible access for human operators.
Security considerations (2)
- The role can retrieve Log Analytics workspace shared keys and change monitoring, data collection, deployments, policy-related configuration, and ManagedOps enrollment.
- Enabling or disabling enrollment affects every Azure VM and Arc-enabled server in the subscription and can change data collection or security posture.
Assignment guidance
Assign to the subscription enrollment administrator and, only where required, on external workspace resource groups. Add Managed Identity Operator and Resource Policy Contributor as documented, review the preview impact, and remove standing access when enrollment changes are complete.
Related roles (2)
- Managed Identity Operator: Required companion user role for the enrollment identity.
- Resource Policy Contributor: Required companion user role for enrollment policy configuration.
Common questions
When should I assign the Essential Machine Management Administrator Azure role?
Assign Essential Machine Management Administrator when you need to: Enable or disable preview Essential machine management for a subscription so Azure VMs and Arc-enabled servers receive curated monitoring, security, and management configuration.; and Select and manage the Log Analytics workspace, Azure Monitor workspace, and user-assigned identity used by subscription enrollment.. Practical scope: Microsoft requires the role on the subscription being enabled and, when monitoring workspaces are in another subscription, on the resource groups containing those workspaces. Parent assignments inherit and can expose workspace keys and management configuration beyond one enrollment.
What permissions does the Essential Machine Management Administrator Azure role grant?
The role definition grants 19 combined control-plane and data-plane actions. Representative operations include: Microsoft.Resources/deployments/*; Microsoft.Insights/dataCollectionRules/read; Microsoft.Insights/dataCollectionRules/write; Microsoft.Monitor/accounts/write; Microsoft.Monitor/accounts/read; and Microsoft.ManagedOps/managedOps/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Essential Machine Management Administrator Azure role?
Key considerations when assigning Essential Machine Management Administrator: The role can retrieve Log Analytics workspace shared keys and change monitoring, data collection, deployments, policy-related configuration, and ManagedOps enrollment.; and Enabling or disabling enrollment affects every Azure VM and Arc-enabled server in the subscription and can change data collection or security posture.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Management and governance →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Essential machine management (preview) →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.