Azure Hybrid + multicloud built-in role

Azure Stack HCI VM Contributor

Azure Stack HCI VM Contributor creates, changes, starts, stops, restarts, and deletes VMs and their attached resources and extensions, but cannot register the system, assign roles, or create shared logical networks, images, and storage paths. The role uses Azure control-plane Actions and has no DataActions; Azure Arc resource bridge and the Azure Local operator project those authorized operations to the on-premises instance.

Control-plane actions (75)

• Microsoft.AzureStackHCI/VirtualMachines/*
• Microsoft.AzureStackHCI/virtualMachineInstances/*
• Microsoft.AzureStackHCI/NetworkInterfaces/*
• Microsoft.AzureStackHCI/VirtualHardDisks/*
• Microsoft.AzureStackHCI/VirtualNetworks/Read
• Microsoft.AzureStackHCI/VirtualNetworks/join/action
• Microsoft.AzureStackHCI/LogicalNetworks/Read
• Microsoft.AzureStackHCI/LogicalNetworks/join/action
• Microsoft.AzureStackHCI/GalleryImages/Read
• Microsoft.AzureStackHCI/GalleryImages/deploy/action
• Microsoft.AzureStackHCI/StorageContainers/Read
• Microsoft.AzureStackHCI/StorageContainers/deploy/action
• Microsoft.AzureStackHCI/MarketplaceGalleryImages/Read
• Microsoft.AzureStackHCI/MarketPlaceGalleryImages/deploy/action
• Microsoft.AzureStackHCI/Clusters/Read
• Microsoft.AzureStackHCI/Clusters/ArcSettings/Read
• Microsoft.AzureStackHCI/NetworkSecurityGroups/Read
• Microsoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/Read
• Microsoft.Insights/AlertRules/Write
• Microsoft.Insights/AlertRules/Delete
• Microsoft.Insights/AlertRules/Read
• Microsoft.Insights/AlertRules/Activated/Action
• Microsoft.Insights/AlertRules/Resolved/Action
• Microsoft.Insights/AlertRules/Throttled/Action
• Microsoft.Insights/AlertRules/Incidents/Read
• Microsoft.Resources/deployments/read
• Microsoft.Resources/deployments/write
• Microsoft.Resources/deployments/delete
• Microsoft.Resources/deployments/cancel/action
• Microsoft.Resources/deployments/validate/action
• Microsoft.Resources/deployments/whatIf/action
• Microsoft.Resources/deployments/exportTemplate/action
• Microsoft.Resources/deployments/operations/read
• Microsoft.Resources/deployments/operationstatuses/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/write
• Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read
• Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read
• Microsoft.ResourceHealth/availabilityStatuses/read
• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/subscriptions/operationresults/read
• Microsoft.HybridCompute/machines/read
• Microsoft.HybridCompute/machines/write
• Microsoft.HybridCompute/machines/delete
• Microsoft.HybridCompute/machines/UpgradeExtensions/action
• Microsoft.HybridCompute/machines/assessPatches/action
• Microsoft.HybridCompute/machines/installPatches/action
• Microsoft.HybridCompute/machines/extensions/read
• Microsoft.HybridCompute/machines/extensions/write
• Microsoft.HybridCompute/machines/extensions/delete
• Microsoft.HybridCompute/operations/read
• Microsoft.HybridCompute/locations/operationresults/read
• Microsoft.HybridCompute/locations/operationstatus/read
• Microsoft.HybridCompute/machines/patchAssessmentResults/read
• Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read
• Microsoft.HybridCompute/machines/patchInstallationResults/read
• Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read
• Microsoft.HybridCompute/locations/updateCenterOperationResults/read
• Microsoft.HybridCompute/machines/hybridIdentityMetadata/read
• Microsoft.HybridCompute/osType/agentVersions/read
• Microsoft.HybridCompute/osType/agentVersions/latest/read
• Microsoft.HybridCompute/machines/runcommands/read
• Microsoft.HybridCompute/machines/runcommands/write
• Microsoft.HybridCompute/machines/runcommands/delete
• Microsoft.HybridCompute/machines/licenseProfiles/read
• Microsoft.HybridCompute/machines/licenseProfiles/write
• Microsoft.HybridCompute/machines/licenseProfiles/delete
• Microsoft.HybridCompute/licenses/read
• Microsoft.HybridCompute/licenses/write
• Microsoft.HybridCompute/licenses/delete
• Microsoft.ExtendedLocation/customLocations/Read
• Microsoft.ExtendedLocation/customLocations/deploy/action
• Microsoft.KubernetesConfiguration/extensions/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the resource group containing the workload VMs and their attached resources. Broader subscription scope exposes every inherited Azure Local workload, while individual-resource assignments may not cover all dependent disks and network interfaces.

Common use cases (1)

• Give an application or VM operations team self-service lifecycle management for its Azure Local VMs and attached disks, network interfaces, and extensions without platform registration or role delegation.

Prerequisites (2)

• The Azure Local instance must be deployed and registered with a connected Azure Arc resource bridge and custom location, and all VM-management entities must be in a supported common Azure region.
• The assigning principal needs Owner or User Access Administrator. The workload must have the required VM image, logical network, storage path, and resource group; same-subscription infrastructure and workloads avoid documented cross-subscription CLI limitations.

Best practices (2)

• Use VM Reader for inspection-only work and leave shared images, logical networks, and storage paths under the platform administrator.
• Prefer resource-group scope, use groups for recurring access, verify the assignment with Check access, and use time-bound activation for privileged administration.

Security considerations (1)

• The role can create, reconfigure, power-cycle, and delete VMs and attached disks and network interfaces and can manage extensions, affecting workload availability and guest execution.

Assignment guidance

Assign Azure Stack HCI VM Contributor to the workload user, group, service principal, or managed identity on the narrowest resource group containing the intended Azure Local resources. Verify access and the bridge state, then remove or lower the assignment when the operational need ends.

Related roles (2)

• Azure Stack HCI Administrator: Provides full Azure Local platform, shared-resource, VM, and constrained delegation authority.
• Azure Stack HCI VM Reader: Provides VM and supporting-resource visibility without VM lifecycle changes.

Editorial sources (8)

• Azure built-in roles for Hybrid + multicloud - Azure RBAC | Microsoft Learn →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Use Role-based Access Control to manage Azure Local VMs enabled by Azure Arc →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Review prerequisites for Azure Local VMs enabled by Azure Arc →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →