Azure Compute built-in role
Virtual Machine User Login
Allows Microsoft Entra-authenticated sign-in to supported Azure virtual machines and Azure Arc-enabled servers as a regular, non-administrator user. It combines control-plane resource visibility with regular-login DataActions; Owner, Contributor, and VM Contributor do not automatically grant this guest access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: fb879df8-f326-4884-b1cf-06f3ad86be52
Control-plane actions (7)
Microsoft.Network/publicIPAddresses/readMicrosoft.Network/virtualNetworks/readMicrosoft.Network/loadBalancers/readMicrosoft.Network/networkInterfaces/readMicrosoft.Compute/virtualMachines/*/readMicrosoft.HybridCompute/machines/*/readMicrosoft.HybridConnectivity/endpoints/listCredentials/action
Data-plane actions (2)
Microsoft.Compute/virtualMachines/login/actionMicrosoft.HybridCompute/machines/login/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
The role can be assigned at management group, subscription, resource group, or resource scope and is inherited by child VMs and Arc machines. Microsoft recommends assigning at a management group, subscription, or resource-group boundary rather than per VM to avoid assignment limits, while ensuring unrelated machines are not included.
Common use cases (2)
- Allow developers or operators to sign in to supported Linux VMs without sudo or root privileges.
- Allow approved users to sign in to supported Windows VMs as regular users through Microsoft Entra authentication.
Prerequisites (2)
- Enable the system-assigned managed identity and install the supported Microsoft Entra login extension or Arc SSH configuration on the target machines.
- Meet the documented OS, region, tenant, network, client, and connectivity requirements for the intended Windows, Linux, or Arc sign-in flow.
Best practices (3)
- Use this role instead of Administrator Login whenever the task does not require elevated guest privileges.
- Assign to groups at a deliberate resource-group or fleet boundary, enforce applicable Conditional Access, and review membership regularly.
- Keep VM lifecycle control separate and use Azure Policy to audit login configuration and local accounts.
Security considerations (3)
- Regular guest access can still read or change any data and applications permitted to the operating-system account.
- The DataActions grant real guest login even though administrator login is excluded.
- A broad parent assignment allows the group to sign in to every supported inherited VM or Arc machine.
Assignment guidance
Assign Virtual Machine User Login to an approved user group at the smallest practical machine-fleet boundary. Enable and test Microsoft Entra sign-in first, apply Conditional Access where supported, and grant Administrator Login only to the smaller population that requires elevation.
Related roles (2)
- Virtual Machine Administrator Login: Documented elevated alternative that adds administrator guest privileges.
- Virtual Machine Data Access Administrator (preview): Microsoft documents this conditioned role for delegating assignment and removal of the two VM login roles.
Common questions
When should I assign the Virtual Machine User Login Azure role?
Assign Virtual Machine User Login when you need to: Allow developers or operators to sign in to supported Linux VMs without sudo or root privileges.; and Allow approved users to sign in to supported Windows VMs as regular users through Microsoft Entra authentication.. Practical scope: The role can be assigned at management group, subscription, resource group, or resource scope and is inherited by child VMs and Arc machines. Microsoft recommends assigning at a management group, subscription, or resource-group boundary rather than per VM to avoid assignment limits, while ensuring unrelated machines are not included.
What permissions does the Virtual Machine User Login Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Network/publicIPAddresses/read; Microsoft.Network/virtualNetworks/read; Microsoft.Network/loadBalancers/read; Microsoft.Network/networkInterfaces/read; Microsoft.Compute/virtualMachines/*/read; and Microsoft.HybridCompute/machines/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Virtual Machine User Login Azure role?
Key considerations when assigning Virtual Machine User Login: Regular guest access can still read or change any data and applications permitted to the operating-system account.; The DataActions grant real guest login even though administrator login is excluded.; and A broad parent assignment allows the group to sign in to every supported inherited VM or Arc machine.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Sign in to a Linux virtual machine using Microsoft Entra ID and OpenSSH →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Sign in to a Windows virtual machine using Microsoft Entra ID →
Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- SSH access to Azure Arc-enabled servers →
Supports: Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.