Azure Compute built-in role
VM Restore Operator
Allows an Azure Backup managed identity to create, update, and delete compute, disk, network, storage, deployment, and extension resources during a virtual-machine restore. It also grants blob DataActions in the staging storage account. The role is preview and is a restore service role, not a general human VM operator role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: dfce8971-25e3-42e3-ba33-6055438e3080
Control-plane actions (41)
Microsoft.Authorization/*/readMicrosoft.Compute/disks/readMicrosoft.Compute/disks/writeMicrosoft.Compute/disks/deleteMicrosoft.Compute/disks/beginGetAccess/actionMicrosoft.Compute/disks/endGetAccess/actionMicrosoft.Compute/locations/diskOperations/readMicrosoft.Compute/virtualMachines/readMicrosoft.Compute/virtualMachines/writeMicrosoft.Compute/virtualMachines/deleteMicrosoft.Compute/virtualMachines/instanceView/readMicrosoft.Compute/virtualMachines/extensions/readMicrosoft.Compute/virtualMachines/extensions/writeMicrosoft.Compute/virtualMachines/extensions/deleteMicrosoft.Insights/alertRules/*Microsoft.Network/locations/operationResults/readMicrosoft.Network/locations/operations/readMicrosoft.Network/locations/usages/readMicrosoft.Network/networkInterfaces/deleteMicrosoft.Network/networkInterfaces/ipconfigurations/readMicrosoft.Network/networkInterfaces/join/actionMicrosoft.Network/networkInterfaces/readMicrosoft.Network/networkInterfaces/writeMicrosoft.Network/networkSecurityGroups/readMicrosoft.Network/networkSecurityGroups/securityRules/readMicrosoft.Network/publicIPAddresses/deleteMicrosoft.Network/publicIPAddresses/join/actionMicrosoft.Network/publicIPAddresses/readMicrosoft.Network/publicIPAddresses/writeMicrosoft.Network/virtualNetworks/readMicrosoft.Network/virtualNetworks/subnets/join/actionMicrosoft.Network/virtualNetworks/subnets/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Storage/checkNameAvailability/readMicrosoft.Storage/storageAccounts/blobServices/containers/deleteMicrosoft.Storage/storageAccounts/blobServices/containers/readMicrosoft.Storage/storageAccounts/blobServices/containers/writeMicrosoft.Storage/storageAccounts/listKeys/actionMicrosoft.Storage/storageAccounts/readMicrosoft.Storage/storageAccounts/write
Data-plane actions (4)
Microsoft.Storage/storageAccounts/blobServices/containers/blobs/deleteMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/readMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/writeMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/add/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign to the managed identity selected for restore on both the target resource group and staging storage account as documented. The target-group assignment is inherited by restored compute and network resources, while the storage assignment covers staging containers and blobs. The role spans control-plane Actions and blob data-plane DataActions.
Common use cases (2)
- Allow Azure Backup to create a new VM or restore disks using a managed identity.
- Permit the restore service to create temporary or target storage, network interfaces, public IPs, disks, VMs, extensions, and staging blobs required by the selected restore option.
Prerequisites (3)
- Select a supported system-assigned or user-assigned managed identity associated with the Recovery Services vault and identify the target resource group and staging storage account.
- Confirm that the recovery point, restore type, region, subscription, zone, network, storage, encryption, and cross-subscription settings are supported.
- The human or automation initiating restore needs the separately documented Backup Operator and source or target permissions for the chosen workflow.
Best practices (3)
- Treat the role as preview and grant it only for the restore window on the target group and staging account.
- Use a dedicated staging account, review restored disk network-access settings, and delete temporary VHDs or blobs after restore when no longer needed.
- Validate the restored VM, reapply resource-scoped RBAC because assignments do not carry to a newly restored VM, and remove temporary service assignments.
Security considerations (3)
- The role can create and delete VMs, disks, network interfaces, public IPs, storage containers, and blobs and can write VM extensions.
- Its blob DataActions expose restored workload data in the staging account, while storage key listing can bypass ordinary data-plane RBAC.
- Restored VMs do not inherit role assignments scoped directly to the original VM and can have different IP, availability, extension, and disk-access state.
Assignment guidance
Assign VM Restore Operator to the approved vault-managed identity on the target resource group and staging storage account immediately before the restore. Keep human Backup Operator access separate, validate and secure the restored resources, and remove the preview service role when cleanup is complete.
Related roles (1)
- Backup Operator: Microsoft documents Backup Operator on the Recovery Services vault for the principal initiating restore, while VM Restore Operator supplies the managed identity permissions on target and staging resources.
Common questions
When should I assign the VM Restore Operator Azure role?
Assign VM Restore Operator when you need to: Allow Azure Backup to create a new VM or restore disks using a managed identity.; and Permit the restore service to create temporary or target storage, network interfaces, public IPs, disks, VMs, extensions, and staging blobs required by the selected restore option.. Practical scope: Assign to the managed identity selected for restore on both the target resource group and staging storage account as documented. The target-group assignment is inherited by restored compute and network resources, while the storage assignment covers staging containers and blobs. The role spans control-plane Actions and blob data-plane DataActions.
What permissions does the VM Restore Operator Azure role grant?
The role definition grants 45 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Compute/disks/read; Microsoft.Compute/disks/write; Microsoft.Compute/disks/delete; Microsoft.Compute/disks/beginGetAccess/action; and Microsoft.Compute/disks/endGetAccess/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the VM Restore Operator Azure role?
Key considerations when assigning VM Restore Operator: The role can create and delete VMs, disks, network interfaces, public IPs, storage containers, and blobs and can write VM extensions.; Its blob DataActions expose restored workload data in the staging account, while storage key listing can bypass ordinary data-plane RBAC.; and Restored VMs do not inherit role assignments scoped directly to the original VM and can have different IP, availability, extension, and disk-access state.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Restore virtual machines by using Azure Backup →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-16.
- Manage backups with Azure role-based access control →
Supports: Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.