Azure Migration built-in role

Azure Local Migrate Execute Expert

Runs and monitors Azure Migrate replication and migration into Azure Local with restricted access. It uses Azure control-plane Actions only and conditionally limits storage role assignments; Hyper-V migration and some automation paths remain preview, while the same role also supports the documented VMware migration flow.

Control-plane actions (40)

• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/write
• Microsoft.Resources/subscriptions/locations/read
• Microsoft.Resources/checkResourceName/action
• Microsoft.Resources/deployments/validate/action
• Microsoft.Resources/deploymentScripts/write
• Microsoft.Resources/deploymentScripts/read
• Microsoft.Resources/links/write
• Microsoft.Authorization/*/read
• Microsoft.Authorization/locks/write
• Microsoft.Authorization/locks/delete
• Microsoft.Insights/alertRules/*
• Microsoft.Migrate/*/read
• Microsoft.ApplicationMigration/*/read
• Microsoft.OffAzure/*/read
• Microsoft.MySQLDiscovery/*/read
• Microsoft.Support/*
• Microsoft.Storage/storageAccounts/*/read
• Microsoft.Storage/storageAccounts/*/write
• Microsoft.Storage/storageAccounts/listKeys/action
• Microsoft.Resources/links/read
• Microsoft.DependencyMap/*/read
• Microsoft.DependencyMap/maps/*/action
• Microsoft.AzureStackHCI/*/Read
• Microsoft.AzureStackHCI/LogicalNetworks/join/action
• Microsoft.AzureStackHCI/NetworkInterfaces/*
• Microsoft.AzureStackHCI/VirtualHardDisks/*
• Microsoft.AzureStackHCI/VirtualMachines/Write
• Microsoft.AzureStackHCI/VirtualMachineInstances/Write
• Microsoft.DataReplication/*/read
• Microsoft.DataReplication/replicationVaults/protectedItems/*
• Microsoft.DataReplication/replicationVaults/replicationExtensions/*
• Microsoft.DataReplication/replicationVaults/replicationPolicies/*
• Microsoft.ExtendedLocation/customLocations/read
• Microsoft.KubernetesConfiguration/extensions/read
• Microsoft.ResourceConnector/appliances/read
• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (6)

• Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*
• Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*
• Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*
• Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*
• Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*
• Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe}))

Assignable scopes (1)

• /

Practical scope

Assign on the resource group containing the Azure Local-based Azure Migrate project and on the Azure Local target resource group when separate. Avoid subscription scope unless the documented cross-scope workflow requires it.

Common use cases (2)

• Let an execution team replicate and migrate discovered Hyper-V or VMware VMs to Azure Local and monitor migration progress without creating the project.
• Run the prepare, discover, replicate, migrate, and verify workflow after the Azure Local target, source appliance, target appliance, and migration project are ready.

Prerequisites (2)

• Azure Local 2503 or later must be deployed, registered, and connected, with Arc resource bridge, a source appliance, a target appliance, an Azure Migrate project, storage, Key Vault, and prepared source VMs.
• Review the lifecycle of the selected path: Hyper-V migration and some PowerShell, CLI, or Terraform workflows are preview and subject to preview terms.

Best practices (2)

• Grant the execution role only after discovery and target readiness are validated, use a time-bounded assignment, and keep the project owner separate.
• Replicate first, verify the protected item is ready, shut down the source for data consistency when documented, validate the migrated VM, and only then decommission the source.

Security considerations (2)

• The role can replicate and cut over VMs and create or change Azure Local target VM resources, affecting source downtime and target workload state.
• Migration data flows locally from the source to Azure Local, while Azure stores orchestration metadata and replication state; the constrained storage assignments still require scope review.

Assignment guidance

Assign Azure Local Migrate Execute Expert to the migration execution group on the Azure Local migration project and target resource groups for the approved window. Verify the target and preview status, keep the role condition intact, and remove access after migrated VMs are validated.

Related roles (1)

• Azure Local Migrate Owner: Creates and manages the Azure Local migration project and delegates the execution role.

Editorial sources (8)

• Azure built-in roles for Migration - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Overview of Azure Migrate based migration for Azure Local (preview) →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• What's new in Azure Migrate for Azure Local →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →