Azure Migration built-in role
Migrate Arc Discovery Reader - Preview
Reads Azure Arc-enabled server metadata and Arc-enabled SQL Server metadata, telemetry, performance, and migration-suitability information for Azure Migrate Arc-based discovery. It is a preview, control-plane-only role with no DataActions and does not change the Arc resources.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 5d5dddae-e124-4753-972d-aae60b37deb4
Control-plane actions (8)
Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.AzureArcData/sqlServerInstances/readMicrosoft.AzureArcData/sqlServerInstances/databases/readMicrosoft.AzureArcData/sqlServerInstances/availabilityGroups/readMicrosoft.AzureArcData/sqlServerInstances/getTelemetry/actionMicrosoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/actionMicrosoft.HybridCompute/machines/readMicrosoft.HybridCompute/machines/extensions/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on every subscription containing Arc resources selected in the Azure Migrate project scope. Manual sync uses the user identity; automatic daily sync uses the Azure Migrate project system-assigned managed identity.
Common use cases (2)
- Let a user manually synchronize Arc-enabled VMware or Hyper-V servers and Arc-enabled SQL Server inventory into a new Azure Migrate project for assessments and business cases.
- Authorize the Azure Migrate project managed identity to synchronize scoped Arc resource metadata automatically every 24 hours.
Prerequisites (2)
- Use a new Azure Migrate project created for Arc resources, register Microsoft.OffAzure in each scoped subscription, and assign Azure Migrate Owner or Owner where the project is created.
- Arc-enabled servers must run Connected Machine Agent 1.46 or later; the preview currently includes VMware or Hyper-V VMs, and optional performance collection uses the Azure Migrate Collector extension.
Best practices (2)
- Assign the role only on subscriptions included in the project scope, use the project managed identity for automatic sync, and remove assignments when subscriptions leave the scope.
- Trigger a manual sync before a time-sensitive assessment and treat preview capabilities and collected metadata as subject to change.
Security considerations (2)
- The role exposes server configuration, operating system, hypervisor, SQL inventory, telemetry, performance, and migration-suitability metadata across each assigned subscription.
- Automatic sync repeats this collection daily under the project managed identity; parent or unrelated subscription assignments broaden discovery beyond the intended project scope.
Assignment guidance
Assign Migrate Arc Discovery Reader - Preview on each in-scope Arc subscription to the user performing manual sync or to the Azure Migrate project managed identity for automatic sync. Keep the project scope and assignments aligned and remove access when discovery ends.
Related roles (2)
- Azure Migrate Owner: Creates the Azure Migrate project that stores Arc discovery metadata and assessments.
- Azure Migrate Decide and Plan Expert: Uses discovered inventory to produce business cases, waves, dependencies, and assessments without granting Arc subscription discovery by itself.
Common questions
When should I assign the Migrate Arc Discovery Reader - Preview Azure role?
Assign Migrate Arc Discovery Reader - Preview when you need to: Let a user manually synchronize Arc-enabled VMware or Hyper-V servers and Arc-enabled SQL Server inventory into a new Azure Migrate project for assessments and business cases.; and Authorize the Azure Migrate project managed identity to synchronize scoped Arc resource metadata automatically every 24 hours.. Practical scope: Assign on every subscription containing Arc resources selected in the Azure Migrate project scope. Manual sync uses the user identity; automatic daily sync uses the Azure Migrate project system-assigned managed identity.
What permissions does the Migrate Arc Discovery Reader - Preview Azure role grant?
The role definition grants 8 combined control-plane and data-plane actions. Representative operations include: Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.AzureArcData/sqlServerInstances/read; Microsoft.AzureArcData/sqlServerInstances/databases/read; Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/read; Microsoft.AzureArcData/sqlServerInstances/getTelemetry/action; and Microsoft.AzureArcData/sqlServerInstances/availabilityGroups/getDetailView/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Migrate Arc Discovery Reader - Preview Azure role?
Key considerations when assigning Migrate Arc Discovery Reader - Preview: The role exposes server configuration, operating system, hypervisor, SQL inventory, telemetry, performance, and migration-suitability metadata across each assigned subscription.; and Automatic sync repeats this collection daily under the project managed identity; parent or unrelated subscription assignments broaden discovery beyond the intended project scope.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Migration - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Eligible and time-bound role assignments in Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Overview of Arc-based discovery in Azure Migrate (preview) →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Manage sync of Arc resources to Azure Migrate project →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.