Azure Hybrid + multicloud built-in role
Azure Stack HCI VM Reader
Azure Stack HCI VM Reader lists Azure Local VMs and their supporting VM resources without changing the VMs or their extensions. The role uses Azure control-plane Actions and has no DataActions; Azure Arc resource bridge and the Azure Local operator project those authorized operations to the on-premises instance.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4b3fe76c-f777-4d24-a2d7-b027b0f7b273
Control-plane actions (42)
Microsoft.AzureStackHCI/VirtualMachines/ReadMicrosoft.AzureStackHCI/virtualMachineInstances/ReadMicrosoft.AzureStackHCI/VirtualMachines/Extensions/ReadMicrosoft.AzureStackHCI/VirtualNetworks/ReadMicrosoft.AzureStackHCI/LogicalNetworks/ReadMicrosoft.AzureStackHCI/NetworkInterfaces/ReadMicrosoft.AzureStackHCI/VirtualHardDisks/ReadMicrosoft.AzureStackHCI/StorageContainers/ReadMicrosoft.AzureStackHCI/GalleryImages/ReadMicrosoft.AzureStackHCI/MarketplaceGalleryImages/ReadMicrosoft.AzureStackHCI/NetworkSecurityGroups/ReadMicrosoft.AzureStackHCI/NetworkSecurityGroups/SecurityRules/ReadMicrosoft.HybridCompute/licenses/readMicrosoft.HybridCompute/machines/extensions/readMicrosoft.HybridCompute/machines/licenseProfiles/readMicrosoft.HybridCompute/machines/patchAssessmentResults/readMicrosoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/readMicrosoft.HybridCompute/machines/patchInstallationResults/readMicrosoft.HybridCompute/machines/patchInstallationResults/softwarePatches/readMicrosoft.HybridCompute/machines/readMicrosoft.HybridCompute/privateLinkScopes/networkSecurityPerimeterConfigurations/readMicrosoft.HybridCompute/privateLinkScopes/privateEndpointConnections/readMicrosoft.HybridCompute/privateLinkScopes/readMicrosoft.Insights/AlertRules/WriteMicrosoft.Insights/AlertRules/DeleteMicrosoft.Insights/AlertRules/ReadMicrosoft.Insights/AlertRules/Activated/ActionMicrosoft.Insights/AlertRules/Resolved/ActionMicrosoft.Insights/AlertRules/Throttled/ActionMicrosoft.Insights/AlertRules/Incidents/ReadMicrosoft.Resources/deployments/readMicrosoft.Resources/deployments/exportTemplate/actionMicrosoft.Resources/deployments/operations/readMicrosoft.Resources/deployments/operationstatuses/readMicrosoft.Resources/subscriptions/resourcegroups/deployments/readMicrosoft.Resources/subscriptions/resourcegroups/deployments/operations/readMicrosoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/readMicrosoft.ResourceHealth/availabilityStatuses/readMicrosoft.Authorization/*/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Resources/subscriptions/operationresults/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the resource group containing the workload VMs and their attached resources. Broader subscription scope exposes every inherited Azure Local workload, while individual-resource assignments may not cover all dependent disks and network interfaces.
Common use cases (1)
- Give an audit, support, or application team read visibility into Azure Local VMs and supporting VM resources without VM lifecycle changes.
Prerequisites (2)
- The Azure Local instance must be deployed and registered with a connected Azure Arc resource bridge and custom location, and all VM-management entities must be in a supported common Azure region.
- The assigning principal needs Owner or User Access Administrator. The workload must have the required VM image, logical network, storage path, and resource group; same-subscription infrastructure and workloads avoid documented cross-subscription CLI limitations.
Best practices (2)
- Use this role for inventory and support visibility, and review the classic alert-rule Actions if the assignment scope contains unrelated alert resources.
- Prefer resource-group scope, use groups for recurring access, verify the assignment with Check access, and use time-bound activation for privileged administration.
Security considerations (1)
- The role cannot mutate VMs, but its published definition also includes classic alert-rule write and delete Actions; it should not be described as universally read-only outside the Azure Local VM resource boundary.
Assignment guidance
Assign Azure Stack HCI VM Reader to the workload user, group, service principal, or managed identity on the narrowest resource group containing the intended Azure Local resources. Verify access and the bridge state, then remove or lower the assignment when the operational need ends.
Related roles (2)
- Azure Stack HCI Administrator: Provides full Azure Local platform, shared-resource, VM, and constrained delegation authority.
- Azure Stack HCI VM Contributor: Provides workload VM lifecycle management without system registration, shared-resource creation, or role delegation.
Common questions
When should I assign the Azure Stack HCI VM Reader Azure role?
Assign Azure Stack HCI VM Reader when you need to: Give an audit, support, or application team read visibility into Azure Local VMs and supporting VM resources without VM lifecycle changes.. Practical scope: Assign on the resource group containing the workload VMs and their attached resources. Broader subscription scope exposes every inherited Azure Local workload, while individual-resource assignments may not cover all dependent disks and network interfaces.
What permissions does the Azure Stack HCI VM Reader Azure role grant?
The role definition grants 42 combined control-plane and data-plane actions. Representative operations include: Microsoft.AzureStackHCI/VirtualMachines/Read; Microsoft.AzureStackHCI/virtualMachineInstances/Read; Microsoft.AzureStackHCI/VirtualMachines/Extensions/Read; Microsoft.AzureStackHCI/VirtualNetworks/Read; Microsoft.AzureStackHCI/LogicalNetworks/Read; and Microsoft.AzureStackHCI/NetworkInterfaces/Read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Stack HCI VM Reader Azure role?
Key considerations when assigning Azure Stack HCI VM Reader: The role cannot mutate VMs, but its published definition also includes classic alert-rule write and delete Actions; it should not be described as universally read-only outside the Azure Local VM resource boundary.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Hybrid + multicloud - Azure RBAC | Microsoft Learn →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Eligible and time-bound role assignments in Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Role-based Access Control to manage Azure Local VMs enabled by Azure Arc →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Review prerequisites for Azure Local VMs enabled by Azure Arc →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.