Azure Hybrid + multicloud built-in role
Azure Stack HCI Device Management Role
Microsoft.AzureStackHCI Device Management Role
Control-plane and data-plane permissions below are imported directly from Microsoft Learn. In-app editorial guidance (use cases, best practices, security notes) and least-privilege recommendations are still pending review.
Role definition ID: 865ae368-6a45-4bd1-8fbf-0d5151f56fc1
Control-plane actions (38)
Microsoft.AzureStackHCI/Clusters/*Microsoft.AzureStackHCI/EdgeDevices/*Microsoft.AzureStackHCI/DevicePools/*/readMicrosoft.AzureStackHCI/EdgeMachines/*/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.HybridContainerService/register/actionMicrosoft.HybridContainerService/kubernetesVersions/readMicrosoft.HybridContainerService/kubernetesVersions/writeMicrosoft.HybridContainerService/skus/readMicrosoft.HybridContainerService/skus/writeMicrosoft.Authorization/roleassignments/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.AzureStackHCI/StorageContainers/WriteMicrosoft.AzureStackHCI/StorageContainers/ReadMicrosoft.AzureStackHCI/LogicalNetworks/ReadMicrosoft.AzureStackHCI/LogicalNetworks/WriteMicrosoft.AzureStackHCI/Register/ActionMicrosoft.GuestConfiguration/guestConfigurationAssignments/readMicrosoft.KubernetesConfiguration/extensions/writeMicrosoft.KubernetesConfiguration/extensions/readMicrosoft.KubernetesConfiguration/extensions/deleteMicrosoft.KubernetesConfiguration/extensions/operations/readMicrosoft.KubernetesConfiguration/namespaces/readMicrosoft.KubernetesConfiguration/operations/readMicrosoft.ResourceConnector/appliances/readMicrosoft.ResourceConnector/appliances/writeMicrosoft.ResourceConnector/appliances/deleteMicrosoft.ResourceConnector/locations/operationresults/readMicrosoft.ResourceConnector/locations/operationsstatus/readMicrosoft.ResourceConnector/appliances/listClusterUserCredential/actionMicrosoft.ResourceConnector/appliances/listKeys/actionMicrosoft.ResourceConnector/appliances/upgradeGraphs/readMicrosoft.ResourceConnector/telemetryconfig/readMicrosoft.ResourceConnector/operations/readMicrosoft.ExtendedLocation/customLocations/deploy/actionMicrosoft.ExtendedLocation/customLocations/readMicrosoft.ExtendedLocation/customLocations/writeMicrosoft.ExtendedLocation/customLocations/delete
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/