Azure Containers built-in role
Azure Red Hat OpenShift Machine API Operator
Azure Red Hat OpenShift Machine API Operator is a service-agent role for the user-assigned managed identity associated with the Machine API operator. It allows that operator to manage cluster machine lifecycle through Azure virtual machines, disks, identities, network interfaces, load balancers, public IPs, and related infrastructure. Azure Red Hat OpenShift creates a separate assignment of this role on the ARO managed resource group for the service-managed resources. Its published permissions are Azure control-plane Actions with no DataActions; it is not a human OpenShift administration role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 0358943c-7e01-48ba-8889-02cc51d78637
Control-plane actions (35)
Microsoft.Compute/availabilitySets/deleteMicrosoft.Compute/availabilitySets/readMicrosoft.Compute/availabilitySets/writeMicrosoft.Compute/diskEncryptionSets/readMicrosoft.Compute/disks/deleteMicrosoft.Compute/galleries/images/versions/readMicrosoft.Compute/skus/readMicrosoft.Compute/virtualMachines/deleteMicrosoft.Compute/virtualMachines/readMicrosoft.Compute/virtualMachines/writeMicrosoft.Compute/capacityReservationGroups/deploy/actionMicrosoft.ManagedIdentity/userAssignedIdentities/assign/actionMicrosoft.Network/applicationSecurityGroups/readMicrosoft.Network/loadBalancers/backendAddressPools/join/actionMicrosoft.Network/loadBalancers/readMicrosoft.Network/loadBalancers/writeMicrosoft.Network/networkInterfaces/deleteMicrosoft.Network/networkInterfaces/join/actionMicrosoft.Network/networkInterfaces/loadBalancers/readMicrosoft.Network/networkInterfaces/readMicrosoft.Network/networkInterfaces/writeMicrosoft.Network/networkSecurityGroups/readMicrosoft.Network/networkSecurityGroups/writeMicrosoft.Network/publicIPAddresses/deleteMicrosoft.Network/publicIPAddresses/join/actionMicrosoft.Network/publicIPAddresses/readMicrosoft.Network/publicIPAddresses/writeMicrosoft.Network/routeTables/readMicrosoft.Network/virtualNetworks/subnets/join/actionMicrosoft.Network/virtualNetworks/subnets/readMicrosoft.Network/applicationSecurityGroups/joinNetworkSecurityRule/actionMicrosoft.Network/loadBalancers/frontendIPConfigurations/join/actionMicrosoft.Network/loadBalancers/inboundNATRules/join/actionMicrosoft.Network/networkSecurityGroups/join/actionMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The ARO service creates the assignment on the managed resource group. For customer-owned resources outside that group, Microsoft documents customer-created assignments to the corresponding Machine API operator identity only at the control-plane and worker subnets plus the documented optional NSG, route table, and Disk Encryption Set resources. Do not infer additional external assignment scopes from the role's Actions.
Common use cases (1)
- Allow the ARO Machine API operator identity to operate service-managed resources in the managed resource group and only the documented customer-owned resources required by the cluster architecture.
Prerequisites (2)
- Deploy an Azure Red Hat OpenShift cluster with managed identities and create the dedicated user-assigned identity for this operator.
- Prepare only the external network or storage resources named for this operator in the current ARO identity architecture and create the documented customer-owned role assignments before cluster creation.
Best practices (2)
- Use the service-created managed-resource-group assignment and reproduce the published external identity-to-role and scope table exactly when using existing identities and role assignments.
- Keep one managed identity per ARO core operator, create customer-owned assignments at the most limited documented external resource scope, and do not reuse these roles for people or application workloads.
Security considerations (2)
- Machine lifecycle authority can create, reconfigure, or delete cluster nodes and associated network and identity resources, affecting the entire cluster.
- A broader customer-created external assignment or a human assignment would grant infrastructure permissions outside the documented ARO component boundary and bypass the separation among core operator identities.
Assignment guidance
Allow the ARO service to create Azure Red Hat OpenShift Machine API Operator on the managed resource group. For customer-owned infrastructure, assign it only to the dedicated Machine API operator identity at the control-plane and worker subnets plus the documented optional NSG, route table, and Disk Encryption Set resources, exactly as listed in the current identity architecture and deployment examples. Do not duplicate the managed-resource-group assignment or extrapolate other external scopes from Actions, and do not grant the role to human administrators.
Related roles (1)
- Azure Red Hat OpenShift Federated Credential: Companion cluster-identity role used to create the federated credentials that let the operator identity authenticate.
Common questions
When should I assign the Azure Red Hat OpenShift Machine API Operator Azure role?
Assign Azure Red Hat OpenShift Machine API Operator when you need to: Allow the ARO Machine API operator identity to operate service-managed resources in the managed resource group and only the documented customer-owned resources required by the cluster architecture.. Practical scope: The ARO service creates the assignment on the managed resource group. For customer-owned resources outside that group, Microsoft documents customer-created assignments to the corresponding Machine API operator identity only at the control-plane and worker subnets plus the documented optional NSG, route table, and Disk Encryption Set resources. Do not infer additional external assignment scopes from the role's Actions.
What permissions does the Azure Red Hat OpenShift Machine API Operator Azure role grant?
The role definition grants 35 combined control-plane and data-plane actions. Representative operations include: Microsoft.Compute/availabilitySets/delete; Microsoft.Compute/availabilitySets/read; Microsoft.Compute/availabilitySets/write; Microsoft.Compute/diskEncryptionSets/read; Microsoft.Compute/disks/delete; and Microsoft.Compute/galleries/images/versions/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Red Hat OpenShift Machine API Operator Azure role?
Key considerations when assigning Azure Red Hat OpenShift Machine API Operator: Machine lifecycle authority can create, reconfigure, or delete cluster nodes and associated network and identity resources, affecting the entire cluster.; and A broader customer-created external assignment or a human assignment would grant infrastructure permissions outside the documented ARO component boundary and bypass the separation among core operator identities.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Understand managed identities in Azure Red Hat OpenShift →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Create an Azure Red Hat OpenShift cluster with managed identities →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.