Azure Compute built-in role

Virtual Machine User Login

Allows Microsoft Entra-authenticated sign-in to supported Azure virtual machines and Azure Arc-enabled servers as a regular, non-administrator user. It combines control-plane resource visibility with regular-login DataActions; Owner, Contributor, and VM Contributor do not automatically grant this guest access.

Control-plane actions (7)

• Microsoft.Network/publicIPAddresses/read
• Microsoft.Network/virtualNetworks/read
• Microsoft.Network/loadBalancers/read
• Microsoft.Network/networkInterfaces/read
• Microsoft.Compute/virtualMachines/*/read
• Microsoft.HybridCompute/machines/*/read
• Microsoft.HybridConnectivity/endpoints/listCredentials/action

Data-plane actions (2)

• Microsoft.Compute/virtualMachines/login/action
• Microsoft.HybridCompute/machines/login/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

The role can be assigned at management group, subscription, resource group, or resource scope and is inherited by child VMs and Arc machines. Microsoft recommends assigning at a management group, subscription, or resource-group boundary rather than per VM to avoid assignment limits, while ensuring unrelated machines are not included.

Common use cases (2)

• Allow developers or operators to sign in to supported Linux VMs without sudo or root privileges.
• Allow approved users to sign in to supported Windows VMs as regular users through Microsoft Entra authentication.

Prerequisites (2)

• Enable the system-assigned managed identity and install the supported Microsoft Entra login extension or Arc SSH configuration on the target machines.
• Meet the documented OS, region, tenant, network, client, and connectivity requirements for the intended Windows, Linux, or Arc sign-in flow.

Best practices (3)

• Use this role instead of Administrator Login whenever the task does not require elevated guest privileges.
• Assign to groups at a deliberate resource-group or fleet boundary, enforce applicable Conditional Access, and review membership regularly.
• Keep VM lifecycle control separate and use Azure Policy to audit login configuration and local accounts.

Security considerations (3)

• Regular guest access can still read or change any data and applications permitted to the operating-system account.
• The DataActions grant real guest login even though administrator login is excluded.
• A broad parent assignment allows the group to sign in to every supported inherited VM or Arc machine.

Assignment guidance

Assign Virtual Machine User Login to an approved user group at the smallest practical machine-fleet boundary. Enable and test Microsoft Entra sign-in first, apply Conditional Access where supported, and grant Administrator Login only to the smaller population that requires elevation.

Related roles (2)

• Virtual Machine Administrator Login: Documented elevated alternative that adds administrator guest privileges.
• Virtual Machine Data Access Administrator (preview): Microsoft documents this conditioned role for delegating assignment and removal of the two VM login roles.

Editorial sources (7)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Sign in to a Linux virtual machine using Microsoft Entra ID and OpenSSH →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Sign in to a Windows virtual machine using Microsoft Entra ID →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• SSH access to Azure Arc-enabled servers →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.

Official Microsoft Learn documentation →