Azure Compute built-in role

Virtual Machine Contributor

Broadly manages Azure virtual machines, scale sets, cloud services, availability resources, disks, network interfaces, VM extensions, Run Command, backup integration, SQL VM resources, serial console, and related deployments. It does not assign Azure RBAC roles and does not automatically grant guest sign-in, but it is not a least-privilege default.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 9980e02c-c2be-4d73-94e8-173b1dc7cf3c

Control-plane actions (45)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign at a VM for one machine or at a dedicated VM resource group for an intentionally managed fleet; parent assignments are inherited. Its published permissions are control-plane Actions with no DataActions, yet extensions, password reset, Run Command, serial console, storage-key listing, and VM lifecycle operations can affect or expose guest workloads.

Common use cases (2)

Prerequisites (3)

Best practices (3)

Security considerations (3)

Assignment guidance

Assign Virtual Machine Contributor only to trusted VM platform operators or deployment automation at the smallest VM or dedicated resource-group scope. Grant network, storage, identity attachment, and guest-login access separately, and choose narrower roles for power, sign-in, or read-only tasks.

Related roles (3)

Common questions

When should I assign the Virtual Machine Contributor Azure role?

Assign Virtual Machine Contributor when you need to: Operate the full lifecycle of an approved VM or scale-set estate, including disks, extensions, monitoring alerts, backup configuration, and supporting network interfaces.; and Run trusted deployment automation that must create, resize, start, stop, update, or delete VMs and execute guest configuration through extensions or Run Command.. Practical scope: Assign at a VM for one machine or at a dedicated VM resource group for an intentionally managed fleet; parent assignments are inherited. Its published permissions are control-plane Actions with no DataActions, yet extensions, password reset, Run Command, serial console, storage-key listing, and VM lifecycle operations can affect or expose guest workloads.

What permissions does the Virtual Machine Contributor Azure role grant?

The role definition grants 45 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Compute/availabilitySets/*; Microsoft.Compute/locations/*; Microsoft.Compute/virtualMachines/*; Microsoft.Compute/virtualMachineScaleSets/*; and Microsoft.Compute/cloudServices/*. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Virtual Machine Contributor Azure role?

Key considerations when assigning Virtual Machine Contributor: Action Run Command executes scripts under the System account on Windows or root on Linux. Managed Run Command can specify a customer-selected user; both variants remain privileged guest-execution paths.; The role can delete VMs and disks, alter network interfaces, connect to serial console, list storage account keys, and change backup resources.; and No DataActions are present and VM login is separate, but control-plane execution and credential-recovery paths can provide effective control over guest data and operating systems.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (13)

Official Microsoft Learn documentation →