Azure Compute built-in role
Virtual Machine Administrator Login
Allows Microsoft Entra-authenticated sign-in to supported Azure virtual machines and Azure Arc-enabled servers with administrator privileges. It combines control-plane resource visibility with login and login-as-administrator DataActions; VM ownership or contribution alone does not provide this guest access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 1c0163c0-47e6-4577-8991-ea5c82e286e4
Control-plane actions (7)
Microsoft.Network/publicIPAddresses/readMicrosoft.Network/virtualNetworks/readMicrosoft.Network/loadBalancers/readMicrosoft.Network/networkInterfaces/readMicrosoft.Compute/virtualMachines/*/readMicrosoft.HybridCompute/machines/*/readMicrosoft.HybridConnectivity/endpoints/listCredentials/action
Data-plane actions (4)
Microsoft.Compute/virtualMachines/login/actionMicrosoft.Compute/virtualMachines/loginAsAdmin/actionMicrosoft.HybridCompute/machines/login/actionMicrosoft.HybridCompute/machines/loginAsAdmin/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role can be assigned at management group, subscription, resource group, or resource scope and is inherited by child VMs and Arc machines. Microsoft recommends a management group, subscription, or resource-group assignment rather than one assignment per VM to avoid role-assignment limits, but the chosen scope must not grant administrator login to unrelated machines.
Common use cases (2)
- Allow a trusted operations group to sign in to supported Windows VMs with local administrator privileges through Microsoft Entra authentication.
- Allow authorized Linux or Arc server administrators to sign in and use sudo or root-equivalent privileges.
Prerequisites (2)
- Enable the system-assigned managed identity and install the supported Microsoft Entra login extension or Arc SSH configuration on the target machines.
- Meet the documented OS, region, tenant, network, client, and connectivity requirements for Windows, Linux, or Arc sign-in.
Best practices (3)
- Use Virtual Machine User Login when administrator privileges are unnecessary.
- Assign to groups at the smallest practical fleet boundary, use Conditional Access and eligible or time-bound PIM access where available, and review membership regularly.
- Keep VM lifecycle administration separate from guest login and use Azure Policy to audit Microsoft Entra login configuration and unapproved local accounts.
Security considerations (3)
- On Linux, the role permits sudo without another authentication step; on Windows it grants administrator sign-in to the guest OS.
- Its DataActions grant guest access even though much of the remaining definition is read-oriented control-plane visibility.
- A broad parent assignment grants administrator login to every supported inherited VM or Arc machine and creates a large credential-compromise blast radius.
Assignment guidance
Assign Virtual Machine Administrator Login to a tightly controlled administrator group at the resource group or other deliberate machine-fleet boundary. Enable and test Microsoft Entra sign-in first, enforce applicable Conditional Access, prefer PIM for people, and use User Login for non-administrative access.
Related roles (2)
- Virtual Machine User Login: Documented regular-user sign-in alternative without administrator privileges.
- Virtual Machine Data Access Administrator (preview): Microsoft documents this conditioned role for delegating assignment and removal of the two VM login roles.
Common questions
When should I assign the Virtual Machine Administrator Login Azure role?
Assign Virtual Machine Administrator Login when you need to: Allow a trusted operations group to sign in to supported Windows VMs with local administrator privileges through Microsoft Entra authentication.; and Allow authorized Linux or Arc server administrators to sign in and use sudo or root-equivalent privileges.. Practical scope: The role can be assigned at management group, subscription, resource group, or resource scope and is inherited by child VMs and Arc machines. Microsoft recommends a management group, subscription, or resource-group assignment rather than one assignment per VM to avoid role-assignment limits, but the chosen scope must not grant administrator login to unrelated machines.
What permissions does the Virtual Machine Administrator Login Azure role grant?
The role definition grants 11 combined control-plane and data-plane actions. Representative operations include: Microsoft.Network/publicIPAddresses/read; Microsoft.Network/virtualNetworks/read; Microsoft.Network/loadBalancers/read; Microsoft.Network/networkInterfaces/read; Microsoft.Compute/virtualMachines/*/read; and Microsoft.HybridCompute/machines/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Virtual Machine Administrator Login Azure role?
Key considerations when assigning Virtual Machine Administrator Login: On Linux, the role permits sudo without another authentication step; on Windows it grants administrator sign-in to the guest OS.; Its DataActions grant guest access even though much of the remaining definition is read-oriented control-plane visibility.; and A broad parent assignment grants administrator login to every supported inherited VM or Arc machine and creates a large credential-compromise blast radius.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Sign in to a Linux virtual machine using Microsoft Entra ID and OpenSSH →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Sign in to a Windows virtual machine using Microsoft Entra ID →
Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- SSH access to Azure Arc-enabled servers →
Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Eligible and time-bound role assignments in Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.