Azure Compute built-in role

Virtual Machine Administrator Login

Allows Microsoft Entra-authenticated sign-in to supported Azure virtual machines and Azure Arc-enabled servers with administrator privileges. It combines control-plane resource visibility with login and login-as-administrator DataActions; VM ownership or contribution alone does not provide this guest access.

Control-plane actions (7)

• Microsoft.Network/publicIPAddresses/read
• Microsoft.Network/virtualNetworks/read
• Microsoft.Network/loadBalancers/read
• Microsoft.Network/networkInterfaces/read
• Microsoft.Compute/virtualMachines/*/read
• Microsoft.HybridCompute/machines/*/read
• Microsoft.HybridConnectivity/endpoints/listCredentials/action

Data-plane actions (4)

• Microsoft.Compute/virtualMachines/login/action
• Microsoft.Compute/virtualMachines/loginAsAdmin/action
• Microsoft.HybridCompute/machines/login/action
• Microsoft.HybridCompute/machines/loginAsAdmin/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role can be assigned at management group, subscription, resource group, or resource scope and is inherited by child VMs and Arc machines. Microsoft recommends a management group, subscription, or resource-group assignment rather than one assignment per VM to avoid role-assignment limits, but the chosen scope must not grant administrator login to unrelated machines.

Common use cases (2)

• Allow a trusted operations group to sign in to supported Windows VMs with local administrator privileges through Microsoft Entra authentication.
• Allow authorized Linux or Arc server administrators to sign in and use sudo or root-equivalent privileges.

Prerequisites (2)

• Enable the system-assigned managed identity and install the supported Microsoft Entra login extension or Arc SSH configuration on the target machines.
• Meet the documented OS, region, tenant, network, client, and connectivity requirements for Windows, Linux, or Arc sign-in.

Best practices (3)

• Use Virtual Machine User Login when administrator privileges are unnecessary.
• Assign to groups at the smallest practical fleet boundary, use Conditional Access and eligible or time-bound PIM access where available, and review membership regularly.
• Keep VM lifecycle administration separate from guest login and use Azure Policy to audit Microsoft Entra login configuration and unapproved local accounts.

Security considerations (3)

• On Linux, the role permits sudo without another authentication step; on Windows it grants administrator sign-in to the guest OS.
• Its DataActions grant guest access even though much of the remaining definition is read-oriented control-plane visibility.
• A broad parent assignment grants administrator login to every supported inherited VM or Arc machine and creates a large credential-compromise blast radius.

Assignment guidance

Assign Virtual Machine Administrator Login to a tightly controlled administrator group at the resource group or other deliberate machine-fleet boundary. Enable and test Microsoft Entra sign-in first, enforce applicable Conditional Access, prefer PIM for people, and use User Login for non-administrative access.

Related roles (2)

• Virtual Machine User Login: Documented regular-user sign-in alternative without administrator privileges.
• Virtual Machine Data Access Administrator (preview): Microsoft documents this conditioned role for delegating assignment and removal of the two VM login roles.

Editorial sources (8)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Sign in to a Linux virtual machine using Microsoft Entra ID and OpenSSH →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Sign in to a Windows virtual machine using Microsoft Entra ID →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• SSH access to Azure Arc-enabled servers →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

• Eligible and time-bound role assignments in Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →