Azure Compute built-in role

Windows Admin Center Administrator Login

Allows administrator-level operating-system management through Windows Admin Center in the Azure portal for supported Windows Azure IaaS VMs. The built-in definition contains permissions for additional resource types, but this reviewed workflow does not claim those platforms without a direct current Microsoft Learn workflow source.

Control-plane actions (41)

• Microsoft.HybridCompute/machines/*/read
• Microsoft.HybridCompute/machines/extensions/*
• Microsoft.HybridCompute/machines/upgradeExtensions/action
• Microsoft.HybridCompute/operations/read
• Microsoft.Network/networkInterfaces/read
• Microsoft.Network/loadBalancers/read
• Microsoft.Network/publicIPAddresses/read
• Microsoft.Network/virtualNetworks/read
• Microsoft.Network/networkSecurityGroups/read
• Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read
• Microsoft.Network/networkWatchers/securityGroupView/action
• Microsoft.Network/networkSecurityGroups/securityRules/read
• Microsoft.Network/networkSecurityGroups/securityRules/write
• Microsoft.HybridConnectivity/endpoints/write
• Microsoft.HybridConnectivity/endpoints/read
• Microsoft.HybridConnectivity/endpoints/serviceConfigurations/write
• Microsoft.HybridConnectivity/endpoints/serviceConfigurations/read
• Microsoft.HybridConnectivity/endpoints/listManagedProxyDetails/action
• Microsoft.Compute/virtualMachines/read
• Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/read
• Microsoft.Compute/virtualMachines/patchAssessmentResults/latest/softwarePatches/read
• Microsoft.Compute/virtualMachines/patchInstallationResults/read
• Microsoft.Compute/virtualMachines/patchInstallationResults/softwarePatches/read
• Microsoft.Compute/virtualMachines/extensions/read
• Microsoft.Compute/virtualMachines/instanceView/read
• Microsoft.Compute/virtualMachines/runCommands/read
• Microsoft.Compute/virtualMachines/vmSizes/read
• Microsoft.Compute/locations/publishers/artifacttypes/types/read
• Microsoft.Compute/locations/publishers/artifacttypes/types/versions/read
• Microsoft.Compute/diskAccesses/read
• Microsoft.Compute/galleries/images/read
• Microsoft.Compute/images/read
• Microsoft.AzureStackHCI/Clusters/Read
• Microsoft.AzureStackHCI/Clusters/ArcSettings/Read
• Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Read
• Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Write
• Microsoft.AzureStackHCI/Clusters/ArcSettings/Extensions/Delete
• Microsoft.AzureStackHCI/Operations/Read
• Microsoft.ConnectedVMwarevSphere/VirtualMachines/Read
• Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Write
• Microsoft.ConnectedVMwarevSphere/VirtualMachines/Extensions/Read

Data-plane actions (4)

• Microsoft.HybridCompute/machines/WACLoginAsAdmin/action
• Microsoft.Compute/virtualMachines/WACloginAsAdmin/action
• Microsoft.AzureStackHCI/Clusters/WACloginAsAdmin/Action
• Microsoft.ConnectedVMwarevSphere/virtualmachines/WACloginAsAdmin/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Because the role includes DataActions, Microsoft documents assignment at subscription, resource group, or resource scope, not management-group scope. Assign at the individual VM or tightly bounded resource group; child resources inherit access. Reader is also required at the VM resource level for the Azure portal Windows Admin Center experience.

Common use cases (2)

• Manage certificates, devices, events, files, firewall, local users, PowerShell, registry, services, storage, updates, and other OS functions through Windows Admin Center in the Azure portal.
• Connect as an administrator to a supported Windows Azure VM without using a conventional RDP session.

Prerequisites (4)

• Use an Azure IaaS VM running Windows Server 2016 or newer, Windows 10, or Windows 11 in Azure public cloud, with at least 3 GiB of memory and a supported browser.
• Install the Windows Admin Center extension by using an identity with Owner or Contributor on the VM.
• For the connecting administrator, grant both Reader and Windows Admin Center Administrator Login at the VM resource level.
• Prefer private-IP connectivity or tightly restrict any required inbound public rule and allow the documented outbound service tags.

Best practices (3)

• Assign at the individual resource or a small administration resource group and use eligible or time-bound access for human administrators where available.
• Use private IP and VNet access instead of exposing the Windows Admin Center port publicly.
• Audit extension, connectivity endpoint, network security rule, and OS management activity and remove access when support duties end.

Security considerations (3)

• Windows Admin Center creates a virtual account in the guest administrators group and exposes powerful OS tools including PowerShell, registry, files, firewall, local users, and updates.
• Portal traffic to Windows Admin Center uses HTTPS, while management inside the VM uses PowerShell and WMI over WinRM; protect both the network path and the administrator session.
• Owner or Contributor alone does not grant Windows Admin Center guest access, preserving a documented separation between resource control and OS administration.

Assignment guidance

Assign Reader and Windows Admin Center Administrator Login on the individual target resource to the approved administrator group. Install the extension through a separately authorized deployment identity, prefer private connectivity, and avoid broad resource-group or subscription assignment unless every inherited resource is intentionally administered.

Related roles (1)

• Reader: Microsoft documents Reader together with Windows Admin Center Administrator Login at the VM resource level for connecting through the Azure portal experience.

Editorial sources (5)

• Azure built-in roles for Compute →

  Supports: Description, Practical scope. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Manage Windows virtual machines using Windows Admin Center in Azure →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →