Azure Compute built-in role
Virtual Machine Data Access Administrator (preview)
Creates and deletes Azure RBAC assignments for only Virtual Machine Administrator Login and Virtual Machine User Login. The preview role has a built-in version 2.0 ABAC condition that constrains its role-assignment Actions to those two role definition IDs; it does not itself sign in to a VM.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 66f75aeb-eabe-4b70-9f1e-c350c4c9ad04
Control-plane actions (14)
Microsoft.Authorization/roleAssignments/writeMicrosoft.Authorization/roleAssignments/deleteMicrosoft.Authorization/*/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Resources/subscriptions/readMicrosoft.Management/managementGroups/readMicrosoft.Network/publicIPAddresses/readMicrosoft.Network/virtualNetworks/readMicrosoft.Network/loadBalancers/readMicrosoft.Network/networkInterfaces/readMicrosoft.Compute/virtualMachines/*/readMicrosoft.HybridCompute/machines/*/readMicrosoft.Resources/deployments/*Microsoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Conditions (1)
Condition version: 2.0
((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{1c0163c0-47e6-4577-8991-ea5c82e286e4, fb879df8-f326-4884-b1cf-06f3ad86be52})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{1c0163c0-47e6-4577-8991-ea5c82e286e4, fb879df8-f326-4884-b1cf-06f3ad86be52}))
Assignable scopes (1)
/
Practical scope
Assign at the management group, subscription, resource group, or resource boundary where the delegate may manage VM login assignments; child scopes inherit that authority. The role uses control-plane Actions and has no DataActions. Its built-in condition limits which roles can be assigned or removed, while the assignment scope determines which VMs are affected.
Common use cases (2)
- Delegate VM sign-in access administration to a platform or application team without allowing arbitrary Azure role assignments.
- Allow an approved VM creator to grant itself or its users regular or administrator login within a bounded VM estate.
Prerequisites (2)
- Confirm the delegate needs to assign or remove only the two Microsoft Entra VM login roles and select the narrowest machine-fleet scope.
- Treat the role as preview and preserve the published built-in condition; do not replace it with an unrestricted role-assignment role for this workflow.
Best practices (3)
- Assign at a dedicated VM resource group rather than subscription scope when the delegate owns one workload.
- Add an additional assignment condition to constrain principal types or specific principals where the delegation model requires it.
- Review delegated administrator assignments and the VM login assignments they create, and reassess the preview definition for changes.
Security considerations (3)
- The delegate can grant administrator guest login to itself or another principal on every VM in the inherited scope unless principal conditions constrain it further.
- The built-in condition limits role IDs but does not by itself limit which eligible principals receive those login roles.
- This is a preview access-administration role; it has no login DataActions and does not grant VM lifecycle management.
Assignment guidance
Assign this preview role to a VM access delegate at the narrowest resource-group or machine scope. Preserve its built-in condition, add principal constraints where appropriate, and use it instead of broad Owner or User Access Administrator for the two documented VM login roles.
Related roles (2)
- Virtual Machine Administrator Login: One of the two login roles the built-in condition permits the delegate to assign or remove.
- Virtual Machine User Login: One of the two login roles the built-in condition permits the delegate to assign or remove.
Common questions
When should I assign the Virtual Machine Data Access Administrator (preview) Azure role?
Assign Virtual Machine Data Access Administrator (preview) when you need to: Delegate VM sign-in access administration to a platform or application team without allowing arbitrary Azure role assignments.; and Allow an approved VM creator to grant itself or its users regular or administrator login within a bounded VM estate.. Practical scope: Assign at the management group, subscription, resource group, or resource boundary where the delegate may manage VM login assignments; child scopes inherit that authority. The role uses control-plane Actions and has no DataActions. Its built-in condition limits which roles can be assigned or removed, while the assignment scope determines which VMs are affected.
What permissions does the Virtual Machine Data Access Administrator (preview) Azure role grant?
The role definition grants 14 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/roleAssignments/write; Microsoft.Authorization/roleAssignments/delete; Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.Resources/subscriptions/read; and Microsoft.Management/managementGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Virtual Machine Data Access Administrator (preview) Azure role?
Key considerations when assigning Virtual Machine Data Access Administrator (preview): The delegate can grant administrator guest login to itself or another principal on every VM in the inherited scope unless principal conditions constrain it further.; The built-in condition limits role IDs but does not by itself limit which eligible principals receive those login roles.; and This is a preview access-administration role; it has no login DataActions and does not grant VM lifecycle management.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Sign in to a Linux virtual machine using Microsoft Entra ID and OpenSSH →
Supports: Description, Practical scope, Related roles. Retrieved 2026-07-16.
- Sign in to a Windows virtual machine using Microsoft Entra ID →
Supports: Related roles. Retrieved 2026-07-16.
- Delegate Azure role assignment management to others with conditions →
Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.