Azure Migration built-in role
Azure Local Migrate Execute Expert
Runs and monitors Azure Migrate replication and migration into Azure Local with restricted access. It uses Azure control-plane Actions only and conditionally limits storage role assignments; Hyper-V migration and some automation paths remain preview, while the same role also supports the documented VMware migration flow.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 1cfa4eac-9a23-481c-a793-bfb6958e836c
Control-plane actions (40)
Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/writeMicrosoft.Resources/subscriptions/locations/readMicrosoft.Resources/checkResourceName/actionMicrosoft.Resources/deployments/validate/actionMicrosoft.Resources/deploymentScripts/writeMicrosoft.Resources/deploymentScripts/readMicrosoft.Resources/links/writeMicrosoft.Authorization/*/readMicrosoft.Authorization/locks/writeMicrosoft.Authorization/locks/deleteMicrosoft.Insights/alertRules/*Microsoft.Migrate/*/readMicrosoft.ApplicationMigration/*/readMicrosoft.OffAzure/*/readMicrosoft.MySQLDiscovery/*/readMicrosoft.Support/*Microsoft.Storage/storageAccounts/*/readMicrosoft.Storage/storageAccounts/*/writeMicrosoft.Storage/storageAccounts/listKeys/actionMicrosoft.Resources/links/readMicrosoft.DependencyMap/*/readMicrosoft.DependencyMap/maps/*/actionMicrosoft.AzureStackHCI/*/ReadMicrosoft.AzureStackHCI/LogicalNetworks/join/actionMicrosoft.AzureStackHCI/NetworkInterfaces/*Microsoft.AzureStackHCI/VirtualHardDisks/*Microsoft.AzureStackHCI/VirtualMachines/WriteMicrosoft.AzureStackHCI/VirtualMachineInstances/WriteMicrosoft.DataReplication/*/readMicrosoft.DataReplication/replicationVaults/protectedItems/*Microsoft.DataReplication/replicationVaults/replicationExtensions/*Microsoft.DataReplication/replicationVaults/replicationPolicies/*Microsoft.ExtendedLocation/customLocations/readMicrosoft.KubernetesConfiguration/extensions/readMicrosoft.ResourceConnector/appliances/readMicrosoft.Authorization/roleAssignments/writeMicrosoft.Authorization/roleAssignments/delete
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (6)
Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*
Conditions (1)
Condition version: 2.0
((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe}))
Assignable scopes (1)
/
Practical scope
Assign on the resource group containing the Azure Local-based Azure Migrate project and on the Azure Local target resource group when separate. Avoid subscription scope unless the documented cross-scope workflow requires it.
Common use cases (2)
- Let an execution team replicate and migrate discovered Hyper-V or VMware VMs to Azure Local and monitor migration progress without creating the project.
- Run the prepare, discover, replicate, migrate, and verify workflow after the Azure Local target, source appliance, target appliance, and migration project are ready.
Prerequisites (2)
- Azure Local 2503 or later must be deployed, registered, and connected, with Arc resource bridge, a source appliance, a target appliance, an Azure Migrate project, storage, Key Vault, and prepared source VMs.
- Review the lifecycle of the selected path: Hyper-V migration and some PowerShell, CLI, or Terraform workflows are preview and subject to preview terms.
Best practices (2)
- Grant the execution role only after discovery and target readiness are validated, use a time-bounded assignment, and keep the project owner separate.
- Replicate first, verify the protected item is ready, shut down the source for data consistency when documented, validate the migrated VM, and only then decommission the source.
Security considerations (2)
- The role can replicate and cut over VMs and create or change Azure Local target VM resources, affecting source downtime and target workload state.
- Migration data flows locally from the source to Azure Local, while Azure stores orchestration metadata and replication state; the constrained storage assignments still require scope review.
Assignment guidance
Assign Azure Local Migrate Execute Expert to the migration execution group on the Azure Local migration project and target resource groups for the approved window. Verify the target and preview status, keep the role condition intact, and remove access after migrated VMs are validated.
Related roles (1)
- Azure Local Migrate Owner: Creates and manages the Azure Local migration project and delegates the execution role.
Common questions
When should I assign the Azure Local Migrate Execute Expert Azure role?
Assign Azure Local Migrate Execute Expert when you need to: Let an execution team replicate and migrate discovered Hyper-V or VMware VMs to Azure Local and monitor migration progress without creating the project.; and Run the prepare, discover, replicate, migrate, and verify workflow after the Azure Local target, source appliance, target appliance, and migration project are ready.. Practical scope: Assign on the resource group containing the Azure Local-based Azure Migrate project and on the Azure Local target resource group when separate. Avoid subscription scope unless the documented cross-scope workflow requires it.
What permissions does the Azure Local Migrate Execute Expert Azure role grant?
The role definition grants 40 combined control-plane and data-plane actions. Representative operations include: Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Resources/subscriptions/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/write; Microsoft.Resources/subscriptions/locations/read; and Microsoft.Resources/checkResourceName/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Local Migrate Execute Expert Azure role?
Key considerations when assigning Azure Local Migrate Execute Expert: The role can replicate and cut over VMs and create or change Azure Local target VM resources, affecting source downtime and target workload state.; and Migration data flows locally from the source to Azure Local, while Azure stores orchestration metadata and replication state; the constrained storage assignments still require scope review.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Migration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Eligible and time-bound role assignments in Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Overview of Azure Migrate based migration for Azure Local (preview) →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- What's new in Azure Migrate for Azure Local →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.