Azure Migration built-in role

Azure Migrate Decide and Plan Expert

Microsoft documents this role for Azure Migrate Decide and Plan phase operations: appliance- or import-based discovery, inventory and dependency review, security insights, business cases, waves, and assessment reports. Its definition has broad Azure Migrate and supporting control-plane Actions, no DataActions, and no roleAssignments/write; the documented operation matrix does not list migration execution for this role.

Control-plane actions (51)

• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/locations/read
• Microsoft.Resources/checkResourceName/action
• Microsoft.Resources/deploymentScripts/write
• Microsoft.Resources/deploymentScripts/read
• Microsoft.Resources/links/write
• Microsoft.Authorization/*/read
• Microsoft.Authorization/locks/write
• Microsoft.Authorization/locks/delete
• Microsoft.Insights/alertRules/*
• Microsoft.Migrate/*
• Microsoft.ApplicationMigration/*
• Microsoft.OffAzure/*
• Microsoft.MySQLDiscovery/*
• Microsoft.Support/*
• Microsoft.DependencyMap/*
• Microsoft.KeyVault/vaults/*
• Microsoft.KeyVault/checkNameAvailability/read
• Microsoft.HybridCompute/machines/read
• Microsoft.HybridCompute/machines/write
• Microsoft.HybridCompute/machines/delete
• Microsoft.HybridCompute/register/action
• Microsoft.Network/virtualNetworks/subnets/write
• Microsoft.Network/virtualNetworks/subnets/join/action
• Microsoft.Network/networkSecurityGroups/join/action
• Microsoft.Network/virtualNetworks/join/action
• Microsoft.Network/privateEndpoints/read
• Microsoft.Network/privateEndpoints/write
• Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write
• Microsoft.Network/privateDnsZones/write
• Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
• Microsoft.Network/privateDnsZones/join/action
• Microsoft.Network/privateDnsZones/A/write
• Microsoft.Network/register/action
• Microsoft.Network/virtualNetworks/subnets/read
• Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read
• Microsoft.Storage/storageAccounts/*/read
• Microsoft.Storage/storageAccounts/*/write
• Microsoft.Storage/storageAccounts/listKeys/action
• Microsoft.GuestConfiguration/register/action
• Microsoft.HybridConnectivity/register/action
• Microsoft.DataReplication/*/read
• Microsoft.DataReplication/register/action
• Microsoft.DataReplication/replicationVaults/write
• Microsoft.RecoveryServices/vaults/*
• Microsoft.RecoveryServices/register/action
• Microsoft.KeyVault/register/action
• Microsoft.AzureArcData/register/action
• Microsoft.Resources/links/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the resource group where the Azure Migrate project is created. Subscription scope permits resource-provider registration and Azure Site Recovery appliance registration but is broader; at resource-group scope, the subscription owner must register required providers first.

Common use cases (2)

• Let migration architects discover the IT estate, manage inventory, analyze dependencies and security insights, and create business cases and assessments before execution.
• Support the Microsoft-documented planning workflow for creating and organizing migration waves and exporting planning artifacts, while migration execution is assigned separately through Azure Migrate Execute Expert.

Prerequisites (2)

• An Azure Migrate project must exist or be created by Azure Migrate Owner, and required resource providers must be registered in advance when this role is assigned at resource-group scope.
• A user registering an Azure Migrate or Azure Site Recovery appliance also needs the Microsoft Entra Application Developer role; Azure Site Recovery appliance registration requires this Azure role at subscription scope.

Best practices (2)

• Use this phase-specific role for planners whose assigned duties follow the documented Decide and Plan operation matrix, and assign Execute Expert separately for migration execution.
• Prefer resource-group scope, verify provider registration before generating the project key, and use an eligible, time-bound assignment when the access is temporary.

Security considerations (2)

• Microsoft documents discovery, inventory, dependencies, security insights, business cases, assessments, and wave planning for this role, not execution. Its broad Microsoft.Migrate and supporting Actions still require scope review rather than being treated as a narrow permission list.
• Subscription scope expands discovery and supporting-resource access and permits operations unavailable at resource-group scope.

Assignment guidance

Have a subscription or resource-group owner assign Azure Migrate Owner to the project lead, then let that owner assign Decide and Plan Expert to the planning user or group on the project resource group. Use subscription scope only for a documented provider or appliance-registration requirement and time-bound the assignment.

Related roles (2)

• Azure Migrate Owner: Creates and manages the Azure Migrate project and can delegate the phase-specific Azure Migrate roles through its constrained assignment permission.
• Azure Migrate Execute Expert: Runs replication, waves, test migrations, and agentless or agent-based migrations and monitors their progress.

Editorial sources (7)

• Azure built-in roles for Migration - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Prepare Azure accounts for Azure Migrate using built-in roles →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →