Azure Hybrid + multicloud built-in role

Azure Stack HCI Administrator

Azure Stack HCI Administrator registers and fully administers the Azure Local instance, cluster, VMs, extensions, shared VM resources, and selected role assignments. The role uses Azure control-plane Actions and has no DataActions; Azure Arc resource bridge and the Azure Local operator project those authorized operations to the on-premises instance.

Control-plane actions (103)

• Microsoft.AzureStackHCI/register/action
• Microsoft.AzureStackHCI/Unregister/Action
• Microsoft.AzureStackHCI/clusters/*
• Microsoft.AzureStackHCI/NetworkSecurityGroups/Read
• Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read
• Microsoft.AzureStackHCI/NetworkSecurityGroups/Write
• Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Write
• Microsoft.AzureStackHCI/NetworkSecurityGroups/Delete
• Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Delete
• Microsoft.AzureStackHCI/NetworkSecurityGroups/join/action
• Microsoft.HybridCompute/register/action
• Microsoft.GuestConfiguration/register/action
• Microsoft.GuestConfiguration/guestConfigurationAssignments/read
• Microsoft.Resources/subscriptions/resourceGroups/write
• Microsoft.Resources/subscriptions/resourceGroups/delete
• Microsoft.HybridConnectivity/register/action
• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete
• Microsoft.Authorization/*/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Management/managementGroups/read
• Microsoft.Support/*
• Microsoft.AzureStackHCI/*
• Microsoft.AzureStackHCI/EdgeMachines/*
• Microsoft.AzureStackHCI/DevicePools/*
• Microsoft.Insights/AlertRules/Write
• Microsoft.Insights/AlertRules/Delete
• Microsoft.Insights/AlertRules/Read
• Microsoft.Insights/AlertRules/Activated/Action
• Microsoft.Insights/AlertRules/Resolved/Action
• Microsoft.Insights/AlertRules/Throttled/Action
• Microsoft.Insights/AlertRules/Incidents/Read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/write
• Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/subscriptions/operationresults/read
• Microsoft.HybridCompute/machines/read
• Microsoft.HybridCompute/machines/write
• Microsoft.HybridCompute/machines/delete
• Microsoft.HybridCompute/machines/UpgradeExtensions/action
• Microsoft.HybridCompute/machines/assessPatches/action
• Microsoft.HybridCompute/machines/installPatches/action
• Microsoft.HybridCompute/machines/extensions/read
• Microsoft.HybridCompute/machines/extensions/write
• Microsoft.HybridCompute/machines/extensions/delete
• Microsoft.HybridCompute/operations/read
• Microsoft.HybridCompute/locations/operationresults/read
• Microsoft.HybridCompute/locations/operationstatus/read
• Microsoft.HybridCompute/machines/patchAssessmentResults/read
• Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read
• Microsoft.HybridCompute/machines/patchInstallationResults/read
• Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read
• Microsoft.HybridCompute/locations/updateCenterOperationResults/read
• Microsoft.HybridCompute/machines/hybridIdentityMetadata/read
• Microsoft.HybridCompute/osType/agentVersions/read
• Microsoft.HybridCompute/osType/agentVersions/latest/read
• Microsoft.HybridCompute/machines/runcommands/read
• Microsoft.HybridCompute/machines/runcommands/write
• Microsoft.HybridCompute/machines/runcommands/delete
• Microsoft.HybridCompute/machines/licenseProfiles/read
• Microsoft.HybridCompute/machines/licenseProfiles/write
• Microsoft.HybridCompute/machines/licenseProfiles/delete
• Microsoft.HybridCompute/licenses/read
• Microsoft.HybridCompute/licenses/write
• Microsoft.HybridCompute/licenses/delete
• Microsoft.ResourceConnector/register/action
• Microsoft.ResourceConnector/appliances/read
• Microsoft.ResourceConnector/appliances/write
• Microsoft.ResourceConnector/appliances/delete
• Microsoft.ResourceConnector/locations/operationresults/read
• Microsoft.ResourceConnector/locations/operationsstatus/read
• Microsoft.ResourceConnector/appliances/listClusterUserCredential/action
• Microsoft.ResourceConnector/appliances/listKeys/action
• Microsoft.ResourceConnector/operations/read
• Microsoft.ExtendedLocation/register/action
• Microsoft.ExtendedLocation/customLocations/read
• Microsoft.ExtendedLocation/customLocations/deploy/action
• Microsoft.ExtendedLocation/customLocations/write
• Microsoft.ExtendedLocation/customLocations/delete
• Microsoft.EdgeMarketplace/offers/read
• Microsoft.EdgeMarketplace/publishers/read
• Microsoft.Kubernetes/register/action
• Microsoft.KubernetesConfiguration/register/action
• Microsoft.KubernetesConfiguration/extensions/write
• Microsoft.KubernetesConfiguration/extensions/read
• Microsoft.KubernetesConfiguration/extensions/delete
• Microsoft.KubernetesConfiguration/extensions/operations/read
• Microsoft.KubernetesConfiguration/namespaces/read
• Microsoft.KubernetesConfiguration/operations/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.AzureStackHCI/StorageContainers/Write
• Microsoft.AzureStackHCI/StorageContainers/Read
• Microsoft.HybridContainerService/register/action
• Microsoft.HybridCompute/settings/write
• Microsoft.HybridCompute/settings/read
• Microsoft.HybridCompute/gateways/read
• Microsoft.HybridCompute/gateways/write
• Microsoft.HybridCompute/gateways/delete

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, a4417e6f-fecd-4de8-b567-7b0420556985})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{f5819b54-e033-4d82-ac66-4fec3cbf3f4c, cd570a14-e51a-42ad-bac8-bafd67325302, b64e21ea-ac4e-4cdf-9dc9-5b892992bee7, 4b3fe76c-f777-4d24-a2d7-b027b0f7b273, 874d1c73-6003-4e60-a13a-cb31ea190a85,865ae368-6a45-4bd1-8fbf-0d5151f56fc1,7b1f81f9-4196-4058-8aae-762e593270df,4633458b-17de-408a-b874-0445c86b69e6,c99c945f-8bd1-4fb1-a903-01460aae6068, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, a4417e6f-fecd-4de8-b567-7b0420556985}))

Assignable scopes (1)

• /

Practical scope

Assign on the Azure Local instance resource group unless administration must span multiple instances. A subscription assignment inherits full cluster authority and constrained delegation to every Azure Local instance below it.

Common use cases (1)

• Give the central Azure Local platform team authority to register and administer the instance, create shared logical networks, images, and storage paths, and delegate the documented Azure Local and supporting service roles.

Prerequisites (2)

• The Azure Local instance must be deployed and registered with a connected Azure Arc resource bridge and custom location, and all VM-management entities must be in a supported common Azure region.
• The assigning principal needs Owner or User Access Administrator. The workload must have the required VM image, logical network, storage path, and resource group; same-subscription infrastructure and workloads avoid documented cross-subscription CLI limitations.

Best practices (2)

• Keep this role with the central platform group, delegate VM Contributor or VM Reader for workload teams, and verify the role-assignment condition before use.
• Prefer resource-group scope, use groups for recurring access, verify the assignment with Check access, and use time-bound activation for privileged administration.

Security considerations (1)

• The role can register or unregister Azure Local, manage clusters and resource groups, deploy extensions and run commands on Arc machines, and create or remove assignments for the role IDs allowed by its condition.

Assignment guidance

Assign Azure Stack HCI Administrator to the Azure Local platform team on the narrowest resource group containing the intended Azure Local resources. Verify access and the bridge state, then remove or lower the assignment when the operational need ends.

Related roles (2)

• Azure Stack HCI VM Contributor: Provides workload VM lifecycle management without system registration, shared-resource creation, or role delegation.
• Azure Stack HCI VM Reader: Provides VM and supporting-resource visibility without VM lifecycle changes.

Editorial sources (8)

• Azure built-in roles for Hybrid + multicloud - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Use Role-based Access Control to manage Azure Local VMs enabled by Azure Arc →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Review prerequisites for Azure Local VMs enabled by Azure Arc →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →