Azure Compute built-in role
Virtual Machine Local User Login
Allows a principal to obtain Azure Arc connectivity credentials and sign in over SSH as a local user that is already configured on an Azure Arc-enabled server. It is an Arc local-account access role, not a Microsoft Entra VM login role, and it has no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 602da2ba-a5c2-41da-b01d-5360126ab525
Control-plane actions (2)
Microsoft.HybridCompute/machines/*/readMicrosoft.HybridConnectivity/endpoints/listCredentials/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the individual Arc-enabled server or a deliberately bounded resource group. Parent assignments are inherited by every Arc machine below the scope. The role uses control-plane machine reads and the endpoint list-credentials action; local operating-system permissions come from the selected local account.
Common use cases (2)
- Connect to an Arc-enabled Windows or Linux server over the Azure Arc SSH channel using an approved existing local account.
- Provide remote maintenance access without requiring a public IP address or open inbound SSH port.
Prerequisites (3)
- The server must be Azure Arc-enabled with a supported Connected Machine agent, SSH service enabled, HybridConnectivity registered, and an SSH service configuration endpoint.
- An Owner or Contributor must perform the one-time connectivity endpoint setup. That setup authority is separate from Virtual Machine Local User Login, which Microsoft documents for connecting after the endpoint exists.
- The local account must already exist and its operating-system permissions must match the approved maintenance task.
Best practices (3)
- Assign on individual Arc machines or a small resource group and use time-bound access for human operators.
- Use Microsoft Entra authentication with VM User or Administrator Login on supported Linux Arc servers when centralized identity is preferred.
- Disable the Arc SSH service configuration and remove local accounts or assignments that are no longer required.
Security considerations (3)
- The role obtains endpoint credentials that enable a remote SSH path to the server even without public inbound connectivity.
- The effective guest privilege is determined by the local account, which can be highly privileged and is outside Microsoft Entra lifecycle controls.
- No DataActions are listed, but the connectivity credential action enables real guest access and must be treated as privileged.
Assignment guidance
Assign Virtual Machine Local User Login only to approved Arc server operators at the individual machine or narrowly bounded resource group. Control the local account separately, prefer centralized Microsoft Entra login where supported, and remove both the role and SSH endpoint when access is no longer needed.
Common questions
When should I assign the Virtual Machine Local User Login Azure role?
Assign Virtual Machine Local User Login when you need to: Connect to an Arc-enabled Windows or Linux server over the Azure Arc SSH channel using an approved existing local account.; and Provide remote maintenance access without requiring a public IP address or open inbound SSH port.. Practical scope: Assign at the individual Arc-enabled server or a deliberately bounded resource group. Parent assignments are inherited by every Arc machine below the scope. The role uses control-plane machine reads and the endpoint list-credentials action; local operating-system permissions come from the selected local account.
What permissions does the Virtual Machine Local User Login Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.HybridCompute/machines/*/read; and Microsoft.HybridConnectivity/endpoints/listCredentials/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Virtual Machine Local User Login Azure role?
Key considerations when assigning Virtual Machine Local User Login: The role obtains endpoint credentials that enable a remote SSH path to the server even without public inbound connectivity.; The effective guest privilege is determined by the local account, which can be highly privileged and is outside Microsoft Entra lifecycle controls.; and No DataActions are listed, but the connectivity credential action enables real guest access and must be treated as privileged.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Compute →
Supports: Description. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Troubleshoot SSH access to Azure Arc-enabled servers →
Supports: Description, Practical scope, Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- SSH access to Azure Arc-enabled servers →
Supports: Common use cases, Prerequisites, Security considerations. Retrieved 2026-07-16.
- Security overview for Azure Arc-enabled servers →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.