Azure Compute built-in role

Virtual Machine Local User Login

Allows a principal to obtain Azure Arc connectivity credentials and sign in over SSH as a local user that is already configured on an Azure Arc-enabled server. It is an Arc local-account access role, not a Microsoft Entra VM login role, and it has no DataActions.

Control-plane actions (2)

• Microsoft.HybridCompute/machines/*/read
• Microsoft.HybridConnectivity/endpoints/listCredentials/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the individual Arc-enabled server or a deliberately bounded resource group. Parent assignments are inherited by every Arc machine below the scope. The role uses control-plane machine reads and the endpoint list-credentials action; local operating-system permissions come from the selected local account.

Common use cases (2)

• Connect to an Arc-enabled Windows or Linux server over the Azure Arc SSH channel using an approved existing local account.
• Provide remote maintenance access without requiring a public IP address or open inbound SSH port.

Prerequisites (3)

• The server must be Azure Arc-enabled with a supported Connected Machine agent, SSH service enabled, HybridConnectivity registered, and an SSH service configuration endpoint.
• An Owner or Contributor must perform the one-time connectivity endpoint setup. That setup authority is separate from Virtual Machine Local User Login, which Microsoft documents for connecting after the endpoint exists.
• The local account must already exist and its operating-system permissions must match the approved maintenance task.

Best practices (3)

• Assign on individual Arc machines or a small resource group and use time-bound access for human operators.
• Use Microsoft Entra authentication with VM User or Administrator Login on supported Linux Arc servers when centralized identity is preferred.
• Disable the Arc SSH service configuration and remove local accounts or assignments that are no longer required.

Security considerations (3)

• The role obtains endpoint credentials that enable a remote SSH path to the server even without public inbound connectivity.
• The effective guest privilege is determined by the local account, which can be highly privileged and is outside Microsoft Entra lifecycle controls.
• No DataActions are listed, but the connectivity credential action enables real guest access and must be treated as privileged.

Assignment guidance

Assign Virtual Machine Local User Login only to approved Arc server operators at the individual machine or narrowly bounded resource group. Control the local account separately, prefer centralized Microsoft Entra login where supported, and remove both the role and SSH endpoint when access is no longer needed.

Editorial sources (7)

• Azure built-in roles for Compute →

  Supports: Description. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Troubleshoot SSH access to Azure Arc-enabled servers →

  Supports: Description, Practical scope, Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• SSH access to Azure Arc-enabled servers →

  Supports: Common use cases, Prerequisites, Security considerations. Retrieved 2026-07-16.

• Security overview for Azure Arc-enabled servers →

  Supports: Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →