Azure Migration built-in role

Azure Migrate Owner

Creates, manages, and deletes Azure Migrate projects and performs the complete Decide, Plan, and Execute journey. It uses control-plane Actions only and has a condition that limits delegated role assignments to Azure Migrate phase roles and the two documented storage roles rather than arbitrary Azure roles.

Control-plane actions (68)

• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/write
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/subscriptions/locations/read
• Microsoft.Resources/checkResourceName/action
• Microsoft.Resources/deploymentScripts/write
• Microsoft.Resources/deploymentScripts/read
• Microsoft.Resources/links/write
• Microsoft.Authorization/*/read
• Microsoft.Authorization/locks/write
• Microsoft.Authorization/locks/delete
• Microsoft.Insights/alertRules/*
• Microsoft.Migrate/*
• Microsoft.ApplicationMigration/*
• Microsoft.OffAzure/*
• Microsoft.Support/*
• Microsoft.MySQLDiscovery/*
• Microsoft.DependencyMap/*
• Microsoft.KeyVault/vaults/*
• Microsoft.KeyVault/checkNameAvailability/read
• Microsoft.HybridCompute/machines/read
• Microsoft.HybridCompute/machines/write
• Microsoft.HybridCompute/machines/delete
• Microsoft.HybridCompute/register/action
• Microsoft.Network/networkInterfaces/read
• Microsoft.Network/networkInterfaces/write
• Microsoft.Network/networkInterfaces/delete
• Microsoft.Network/virtualNetworks/read
• Microsoft.Network/virtualNetworks/subnets/write
• Microsoft.Network/virtualNetworks/subnets/join/action
• Microsoft.Network/networkSecurityGroups/join/action
• Microsoft.Network/virtualNetworks/join/action
• Microsoft.Network/privateEndpoints/read
• Microsoft.Network/privateEndpoints/write
• Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write
• Microsoft.Network/privateDnsZones/write
• Microsoft.Network/privateDnsZones/virtualNetworkLinks/write
• Microsoft.Network/privateDnsZones/join/action
• Microsoft.Network/privateDnsZones/A/write
• Microsoft.Network/register/action
• Microsoft.Network/virtualNetworks/subnets/read
• Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read
• Microsoft.Storage/storageAccounts/*
• Microsoft.GuestConfiguration/register/action
• Microsoft.Compute/register/action
• Microsoft.Compute/availabilitySets/read
• Microsoft.Compute/availabilitySets/vmSizes/read
• Microsoft.Compute/diskEncryptionSets/read
• Microsoft.Compute/skus/read
• Microsoft.Compute/disks/read
• Microsoft.Compute/disks/write
• Microsoft.Compute/disks/delete
• Microsoft.Compute/virtualMachines/read
• Microsoft.Compute/virtualMachines/write
• Microsoft.Compute/virtualMachines/delete
• Microsoft.HybridConnectivity/register/action
• Microsoft.RecoveryServices/vaults/*
• Microsoft.RecoveryServices/register/action
• Microsoft.RecoveryServices/operations/read
• Microsoft.DataReplication/*/read
• Microsoft.DataReplication/register/action
• Microsoft.DataReplication/replicationVaults/write
• Microsoft.KeyVault/register/action
• Microsoft.AzureArcData/register/action
• Microsoft.Resources/links/read
• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63}))

Assignable scopes (1)

• /

Practical scope

Assign on the resource group where the Azure Migrate project is created. Subscription scope can register providers and support cross-resource operations but inherits authority to every Azure Migrate project and supporting resource below it.

Common use cases (2)

• Give the migration program owner end-to-end project creation, discovery, assessment, wave, replication, migration, and support capabilities.
• Delegate Decide and Plan Expert and Execute Expert to planning and execution teams while retaining project ownership.

Prerequisites (2)

• The assigning principal must be subscription or resource-group Owner, and required Azure Migrate resource providers must be registered when using resource-group scope.
• Appliance registration also requires Microsoft Entra Application Developer; target resource access must be planned separately when migrations land outside the project resource group.

Best practices (2)

• Reserve this owner role for the small project-lead group, delegate phase-specific roles for routine work, and use eligible, time-bound assignments.
• Prefer resource-group scope and audit every role assignment the owner creates or removes during the migration program.

Security considerations (2)

• The role controls the migration project and supporting Key Vault, storage, network, compute, recovery, and migration resources and can execute workload cutovers.
• Its conditional delegation is narrower than general Owner, but it can still grant migration and storage roles at inherited scopes and should be treated as privileged.

Assignment guidance

A subscription or resource-group owner should assign Azure Migrate Owner to the migration project lead on the project resource group, preferably as eligible and time-bound. The project lead should delegate phase roles to groups, not broaden this owner assignment, and remove access when the migration program closes.

Related roles (2)

• Azure Migrate Decide and Plan Expert: Microsoft documents it for discovery, inventory, dependency, business-case, wave, and assessment work rather than migration execution.
• Azure Migrate Execute Expert: Runs replication, waves, test migrations, and agentless or agent-based migrations and monitors their progress.

Editorial sources (7)

• Azure built-in roles for Migration - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Prepare Azure accounts for Azure Migrate using built-in roles →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →