Azure built-in roles · compute
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 8d43c80 · +0 −796 lines · also on GitHub
⋯ 6 unchanged lines
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10
−ms.date: 05/25/2026
11
−ms.custom: generated
12
−---
13
−
14
−# Azure built-in roles for Compute
15
−
16
−This article lists the Azure built-in roles in the Compute category.
17
−
18
−
19
−## Azure Arc VMware VM Contributor
20
−
21
−Arc VMware VM Contributor has permissions to perform all VM actions.
22
−
23
−[Learn more](/azure/azure-arc/vmware-vsphere/setup-and-manage-self-service-access)
24
−
25
−> [!div class="mx-tableFixed"]
26
−> | Actions | Description |
27
−> | --- | --- |
28
−> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/virtualmachines/* | |
29
−> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/virtualmachineinstances/* | |
30
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |
31
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |
32
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |
33
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |
34
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |
35
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |
36
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |
37
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
38
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |
39
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |
40
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/cancel/action | Cancels a deployment. |
41
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates a deployment. |
42
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/whatIf/action | Predicts template deployment changes. |
43
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |
44
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
45
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
46
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/read | Gets or lists deployments. |
47
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/write | Creates or updates an deployment. |
48
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operations/read | Gets or lists deployment operations. |
49
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
50
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
51
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
52
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
53
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
54
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
55
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |
56
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/write | Writes an Azure Arc machines |
57
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/delete | Deletes an Azure Arc machines |
58
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/UpgradeExtensions/action | Upgrades Extensions on Azure Arc machines |
59
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/assessPatches/action | Assesses any Azure Arc machines to get missing software patches |
60
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/installPatches/action | Installs patches on any Azure Arc machines |
61
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/read | Reads any Azure Arc extensions |
62
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/write | Installs or Updates an Azure Arc extensions |
63
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/delete | Deletes an Azure Arc extensions |
64
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/operations/read | Read all Operations for Azure Arc for Servers |
65
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationresults/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |
66
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationstatus/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |
67
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/read | Reads any Azure Arc patchAssessmentResults |
68
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/softwarePatches/read | Reads any Azure Arc patchAssessmentResults/softwarePatches |
69
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/read | Reads any Azure Arc patchInstallationResults |
70
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/softwarePatches/read | Reads any Azure Arc patchInstallationResults/softwarePatches |
71
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/updateCenterOperationResults/read | Reads the status of an update center operation on machines |
72
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/hybridIdentityMetadata/read | Read any Azure Arc machines's Hybrid Identity Metadata |
73
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/read | Read all Azure Connected Machine Agent versions available |
74
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/latest/read | Read the latest Azure Connected Machine Agent version |
75
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/read | Reads any Azure Arc runcommands |
76
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/write | Installs or Updates an Azure Arc runcommands |
77
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/delete | Deletes an Azure Arc runcommands |
78
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/read | Reads any Azure Arc licenseProfiles |
79
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/write | Installs or Updates an Azure Arc licenseProfiles |
80
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/delete | Deletes an Azure Arc licenseProfiles |
81
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/read | Reads any Azure Arc licenses |
82
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/write | Installs or Updates an Azure Arc licenses |
83
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/delete | Deletes an Azure Arc licenses |
84
−> | **NotActions** | |
85
−> | *none* | |
86
−> | **DataActions** | |
87
−> | *none* | |
88
−> | **NotDataActions** | |
89
−> | *none* | |
90
−
91
−```json
92
−{
93
− "assignableScopes": [
94
− "/"
95
− ],
96
− "description": "Arc VMware VM Contributor has permissions to perform all VM actions.",
97
− "id": "/providers/Microsoft.Authorization/roleDefinitions/b748a06d-6150-4f8a-aaa9-ce3940cd96cb",
98
− "name": "b748a06d-6150-4f8a-aaa9-ce3940cd96cb",
99
− "permissions": [
100
− {
101
− "actions": [
102
− "Microsoft.ConnectedVMwarevSphere/virtualmachines/*",
103
− "Microsoft.ConnectedVMwarevSphere/virtualmachineinstances/*",
104
− "Microsoft.Insights/AlertRules/Write",
105
− "Microsoft.Insights/AlertRules/Delete",
106
− "Microsoft.Insights/AlertRules/Read",
107
− "Microsoft.Insights/AlertRules/Activated/Action",
108
− "Microsoft.Insights/AlertRules/Resolved/Action",
109
− "Microsoft.Insights/AlertRules/Throttled/Action",
110
− "Microsoft.Insights/AlertRules/Incidents/Read",
111
− "Microsoft.Resources/deployments/read",
112
− "Microsoft.Resources/deployments/write",
113
− "Microsoft.Resources/deployments/delete",
114
− "Microsoft.Resources/deployments/cancel/action",
115
− "Microsoft.Resources/deployments/validate/action",
116
− "Microsoft.Resources/deployments/whatIf/action",
117
− "Microsoft.Resources/deployments/exportTemplate/action",
118
− "Microsoft.Resources/deployments/operations/read",
119
− "Microsoft.Resources/deployments/operationstatuses/read",
120
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
121
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
122
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
123
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
124
− "Microsoft.ResourceHealth/availabilityStatuses/read",
125
− "Microsoft.Authorization/*/read",
126
− "Microsoft.Resources/subscriptions/read",
127
− "Microsoft.Resources/subscriptions/resourceGroups/read",
128
− "Microsoft.Resources/subscriptions/operationresults/read",
129
− "Microsoft.HybridCompute/machines/read",
130
− "Microsoft.HybridCompute/machines/write",
131
− "Microsoft.HybridCompute/machines/delete",
132
− "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
133
− "Microsoft.HybridCompute/machines/assessPatches/action",
134
− "Microsoft.HybridCompute/machines/installPatches/action",
135
− "Microsoft.HybridCompute/machines/extensions/read",
136
− "Microsoft.HybridCompute/machines/extensions/write",
137
− "Microsoft.HybridCompute/machines/extensions/delete",
138
− "Microsoft.HybridCompute/operations/read",
139
− "Microsoft.HybridCompute/locations/operationresults/read",
140
− "Microsoft.HybridCompute/locations/operationstatus/read",
141
− "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
142
− "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
143
− "Microsoft.HybridCompute/machines/patchInstallationResults/read",
144
− "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
145
− "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
146
− "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
147
− "Microsoft.HybridCompute/osType/agentVersions/read",
148
− "Microsoft.HybridCompute/osType/agentVersions/latest/read",
149
− "Microsoft.HybridCompute/machines/runcommands/read",
150
− "Microsoft.HybridCompute/machines/runcommands/write",
151
− "Microsoft.HybridCompute/machines/runcommands/delete",
152
− "Microsoft.HybridCompute/machines/licenseProfiles/read",
153
− "Microsoft.HybridCompute/machines/licenseProfiles/write",
154
− "Microsoft.HybridCompute/machines/licenseProfiles/delete",
155
− "Microsoft.HybridCompute/licenses/read",
156
− "Microsoft.HybridCompute/licenses/write",
157
− "Microsoft.HybridCompute/licenses/delete"
158
− ],
159
− "notActions": [],
160
− "dataActions": [],
161
− "notDataActions": []
162
− }
163
− ],
164
− "roleName": "Azure Arc VMware VM Contributor",
165
− "roleType": "BuiltInRole",
166
− "type": "Microsoft.Authorization/roleDefinitions"
167
−}
168
−```
169
−
170
−## Azure Batch Account Contributor
171
−
172
−Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.
173
−
174
−[Learn more](/azure/batch/batch-role-based-access-control)
175
−
176
−> [!div class="mx-tableFixed"]
177
−> | Actions | Description |
178
−> | --- | --- |
179
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
180
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/* | Manage all Batch resources. |
181
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
182
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
183
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
184
−> | **NotActions** | |
185
−> | *none* | |
186
−> | **DataActions** | |
187
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/* | Manage all Batch resources. |
188
−> | **NotDataActions** | |
189
−> | *none* | |
190
−
191
−```json
192
−{
193
− "assignableScopes": [
194
− "/"
195
− ],
196
− "description": "Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.",
197
− "id": "/providers/Microsoft.Authorization/roleDefinitions/29fe4964-1e60-436b-bd3a-77fd4c178b3c",
198
− "name": "29fe4964-1e60-436b-bd3a-77fd4c178b3c",
199
− "permissions": [
200
− {
201
− "actions": [
202
− "Microsoft.Authorization/*/read",
203
− "Microsoft.Batch/*",
204
− "Microsoft.Insights/alertRules/*",
205
− "Microsoft.Resources/deployments/*",
206
− "Microsoft.Resources/subscriptions/resourceGroups/read"
207
− ],
208
− "notActions": [],
209
− "dataActions": [
210
− "Microsoft.Batch/*"
211
− ],
212
− "notDataActions": []
213
− }
214
− ],
215
− "roleName": "Azure Batch Account Contributor",
216
− "roleType": "BuiltInRole",
217
− "type": "Microsoft.Authorization/roleDefinitions"
218
−}
219
−```
220
−
221
−## Azure Batch Account Reader
222
−
223
−Lets you view all resources including pools and jobs in the Batch account.
224
−
225
−[Learn more](/azure/batch/batch-role-based-access-control)
226
−
227
−> [!div class="mx-tableFixed"]
228
−> | Actions | Description |
229
−> | --- | --- |
230
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/*/read | View all resources in Batch account. |
231
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
232
−> | **NotActions** | |
233
−> | *none* | |
234
−> | **DataActions** | |
235
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/*/read | View all resources in Batch account. |
236
−> | **NotDataActions** | |
237
−> | *none* | |
238
−
239
−```json
240
−{
241
− "assignableScopes": [
242
− "/"
243
− ],
244
− "description": "Lets you view all resources including pools and jobs in the Batch account.",
245
− "id": "/providers/Microsoft.Authorization/roleDefinitions/11076f67-66f6-4be0-8f6b-f0609fd05cc9",
246
− "name": "11076f67-66f6-4be0-8f6b-f0609fd05cc9",
247
− "permissions": [
248
− {
249
− "actions": [
250
− "Microsoft.Batch/*/read",
251
− "Microsoft.Resources/subscriptions/resourceGroups/read"
252
− ],
253
− "notActions": [],
254
− "dataActions": [
255
− "Microsoft.Batch/*/read"
256
− ],
257
− "notDataActions": []
258
− }
259
− ],
260
− "roleName": "Azure Batch Account Reader",
261
− "roleType": "BuiltInRole",
262
− "type": "Microsoft.Authorization/roleDefinitions"
263
−}
264
−```
265
−
266
−## Azure Batch Data Contributor
267
−
268
−Grants permissions to manage Batch pools and jobs but not to modify accounts.
269
−
270
−[Learn more](/azure/batch/batch-role-based-access-control)
271
−
272
−> [!div class="mx-tableFixed"]
273
−> | Actions | Description |
274
−> | --- | --- |
275
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
276
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/read | Lists Batch accounts or gets the properties of a Batch account |
277
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/applications/* | Create and manage applications and application packages on a Batch account. |
278
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/certificates/* | Create and manage certificates on a Batch account. (Warning: Certificate feature was retired) |
279
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/certificateOperationResults/* | Gets the results of a long running certificate operation on a Batch account. (Warning: Certificate feature was retired) |
280
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/pools/* | Create and manage pools on a Batch account. |
281
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/poolOperationResults/* | Gets the results of a long running pool operation on a Batch account. |
282
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/locations/*/read | Get Batch account operation result/Batch quota/supported VM size at the given location. |
283
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
284
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
285
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
286
−> | **NotActions** | |
287
−> | *none* | |
288
−> | **DataActions** | |
289
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobSchedules/* | Create and manage job schedules on a Batch account. |
290
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobs/* | Create and manage jobs on a Batch account. |
291
−> | **NotDataActions** | |
292
−> | *none* | |
293
−
294
−```json
295
−{
296
− "assignableScopes": [
297
− "/"
298
− ],
299
− "description": "Grants permissions to manage Batch pools and jobs but not to modify accounts.",
300
− "id": "/providers/Microsoft.Authorization/roleDefinitions/6aaa78f1-f7de-44ca-8722-c64a23943cae",
301
− "name": "6aaa78f1-f7de-44ca-8722-c64a23943cae",
302
− "permissions": [
303
− {
304
− "actions": [
305
− "Microsoft.Authorization/*/read",
306
− "Microsoft.Batch/batchAccounts/read",
307
− "Microsoft.Batch/batchAccounts/applications/*",
308
− "Microsoft.Batch/batchAccounts/certificates/*",
309
− "Microsoft.Batch/batchAccounts/certificateOperationResults/*",
310
− "Microsoft.Batch/batchAccounts/pools/*",
311
− "Microsoft.Batch/batchAccounts/poolOperationResults/*",
312
− "Microsoft.Batch/locations/*/read",
313
− "Microsoft.Insights/alertRules/*",
314
− "Microsoft.Resources/deployments/*",
315
− "Microsoft.Resources/subscriptions/resourceGroups/read"
316
− ],
317
− "notActions": [],
318
− "dataActions": [
319
− "Microsoft.Batch/batchAccounts/jobSchedules/*",
320
− "Microsoft.Batch/batchAccounts/jobs/*"
321
− ],
322
− "notDataActions": []
323
− }
324
− ],
325
− "roleName": "Azure Batch Data Contributor",
326
− "roleType": "BuiltInRole",
327
− "type": "Microsoft.Authorization/roleDefinitions"
328
−}
329
−```
330
−
331
−## Azure Batch Job Submitter
332
−
333
−Lets you submit and manage jobs in the Batch account.
334
−
335
−[Learn more](/azure/batch/batch-role-based-access-control)
336
−
337
−> [!div class="mx-tableFixed"]
338
−> | Actions | Description |
339
−> | --- | --- |
340
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/applications/read | Lists applications or gets the properties of an application |
341
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/applications/versions/read | Gets the properties of an application package |
342
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/pools/read | Lists pools on a Batch account or gets the properties of a pool |
343
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
344
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
345
−> | **NotActions** | |
346
−> | *none* | |
347
−> | **DataActions** | |
348
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobSchedules/* | Create and manage job schedules on a Batch account. |
349
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobs/* | Create and manage jobs on a Batch account. |
350
−> | **NotDataActions** | |
351
−> | *none* | |
352
−
353
−```json
354
−{
355
− "assignableScopes": [
356
− "/"
357
− ],
358
− "description": "Lets you submit and manage jobs in the Batch account.",
359
− "id": "/providers/Microsoft.Authorization/roleDefinitions/48e5e92e-a480-4e71-aa9c-2778f4c13781",
360
− "name": "48e5e92e-a480-4e71-aa9c-2778f4c13781",
361
− "permissions": [
362
− {
363
− "actions": [
364
− "Microsoft.Batch/batchAccounts/applications/read",
365
− "Microsoft.Batch/batchAccounts/applications/versions/read",
366
− "Microsoft.Batch/batchAccounts/pools/read",
367
− "Microsoft.Insights/alertRules/*",
368
− "Microsoft.Resources/subscriptions/resourceGroups/read"
369
− ],
370
− "notActions": [],
371
− "dataActions": [
372
− "Microsoft.Batch/batchAccounts/jobSchedules/*",
373
− "Microsoft.Batch/batchAccounts/jobs/*"
374
− ],
375
− "notDataActions": []
376
− }
377
− ],
378
− "roleName": "Azure Batch Job Submitter",
379
− "roleType": "BuiltInRole",
380
− "type": "Microsoft.Authorization/roleDefinitions"
381
−}
382
−```
383
−
384
−## Classic Virtual Machine Contributor
385
−
386
−Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.
387
−
388
−> [!div class="mx-tableFixed"]
389
−> | Actions | Description |
390
−> | --- | --- |
391
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
392
−> | Microsoft.ClassicCompute/domainNames/* | Create and manage classic compute domain names |
393
−> | Microsoft.ClassicCompute/virtualMachines/* | Create and manage virtual machines |
394
−> | Microsoft.ClassicNetwork/networkSecurityGroups/join/action | |
395
−> | Microsoft.ClassicNetwork/reservedIps/link/action | |
396
−> | Microsoft.ClassicNetwork/reservedIps/read | |
397
−> | Microsoft.ClassicNetwork/virtualNetworks/join/action | |
398
−> | Microsoft.ClassicNetwork/virtualNetworks/read | |
399
−> | Microsoft.ClassicStorage/storageAccounts/disks/read | |
400
−> | Microsoft.ClassicStorage/storageAccounts/images/read | |
401
−> | Microsoft.ClassicStorage/storageAccounts/listKeys/action | |
402
−> | Microsoft.ClassicStorage/storageAccounts/read | |
403
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
404
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
405
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
406
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
407
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
408
−> | **NotActions** | |
409
−> | *none* | |
410
−> | **DataActions** | |
411
−> | *none* | |
412
−> | **NotDataActions** | |
413
−> | *none* | |
414
−
415
−```json
416
−{
417
− "assignableScopes": [
418
− "/"
419
− ],
420
− "description": "Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.",
421
− "id": "/providers/Microsoft.Authorization/roleDefinitions/d73bb868-a0df-4d4d-bd69-98a00b01fccb",
422
− "name": "d73bb868-a0df-4d4d-bd69-98a00b01fccb",
423
− "permissions": [
424
− {
425
− "actions": [
426
− "Microsoft.Authorization/*/read",
427
− "Microsoft.ClassicCompute/domainNames/*",
428
− "Microsoft.ClassicCompute/virtualMachines/*",
429
− "Microsoft.ClassicNetwork/networkSecurityGroups/join/action",
430
− "Microsoft.ClassicNetwork/reservedIps/link/action",
431
− "Microsoft.ClassicNetwork/reservedIps/read",
432
− "Microsoft.ClassicNetwork/virtualNetworks/join/action",
433
− "Microsoft.ClassicNetwork/virtualNetworks/read",
434
− "Microsoft.ClassicStorage/storageAccounts/disks/read",
435
− "Microsoft.ClassicStorage/storageAccounts/images/read",
436
− "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
437
− "Microsoft.ClassicStorage/storageAccounts/read",
438
− "Microsoft.Insights/alertRules/*",
439
− "Microsoft.ResourceHealth/availabilityStatuses/read",
440
− "Microsoft.Resources/deployments/*",
441
− "Microsoft.Resources/subscriptions/resourceGroups/read",
442
− "Microsoft.Support/*"
443
− ],
444
− "notActions": [],
445
− "dataActions": [],
446
− "notDataActions": []
447
− }
448
− ],
449
− "roleName": "Classic Virtual Machine Contributor",
450
− "roleType": "BuiltInRole",
451
− "type": "Microsoft.Authorization/roleDefinitions"
452
−}
453
−```
454
−
455
−## Compute Fleet Contributor
456
−
457
−Allows users to manage Compute Fleet resources.
458
−
459
−> [!div class="mx-tableFixed"]
460
−> | Actions | Description |
461
−> | --- | --- |
462
−> | [Microsoft.AzureFleet](../permissions/compute.md#microsoftazurefleet)/fleets/* | Create and manage compute fleets |
463
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
464
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
465
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
466
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
467
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
468
−> | **NotActions** | |
469
−> | *none* | |
470
−> | **DataActions** | |
471
−> | *none* | |
472
−> | **NotDataActions** | |
473
−> | *none* | |
474
−
475
−```json
476
−{
477
− "assignableScopes": [
478
− "/"
479
− ],
480
− "description": "Allows users to manage Compute Fleet resources.",
481
− "id": "/providers/Microsoft.Authorization/roleDefinitions/2bed379c-9fba-455b-99e4-6b911073bcf2",
482
− "name": "2bed379c-9fba-455b-99e4-6b911073bcf2",
483
− "permissions": [
484
− {
485
− "actions": [
486
− "Microsoft.AzureFleet/fleets/*",
487
− "Microsoft.Authorization/*/read",
488
− "Microsoft.Insights/alertRules/*",
489
− "Microsoft.ResourceHealth/availabilityStatuses/read",
490
− "Microsoft.Resources/deployments/*",
491
− "Microsoft.Resources/subscriptions/resourceGroups/read"
492
− ],
493
− "notActions": [],
494
− "dataActions": [],
495
− "notDataActions": []
496
− }
497
− ],
498
− "roleName": "Compute Fleet Contributor",
499
− "roleType": "BuiltInRole",
500
− "type": "Microsoft.Authorization/roleDefinitions"
501
−}
502
−```
503
−
504
−## Compute Gallery Artifacts Publisher
505
−
506
−This is the role for publishing gallery artifacts.
507
−
508
−> [!div class="mx-tableFixed"]
509
−> | Actions | Description |
510
−> | --- | --- |
511
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/* | |
512
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/capsOperations/read | Gets the status of an asynchronous Caps operation |
513
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/communityGalleries/* | |
514
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/sharedGalleries/* | |
515
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/images/* | |
516
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/write | Creates a new virtual machine or updates an existing virtual machine |
517
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/write | Creates a new Disk or updates an existing one |
518
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
519
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
520
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
521
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
522
−> | **NotActions** | |
523
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/share/action | Shares a Gallery to different scopes |
524
−> | **DataActions** | |
525
−> | *none* | |
526
−> | **NotDataActions** | |
527
−> | *none* | |
528
−
529
−```json
530
−{
531
− "assignableScopes": [
532
− "/"
533
− ],
534
− "description": "This is the role for publishing gallery artifacts.",
535
− "id": "/providers/Microsoft.Authorization/roleDefinitions/85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
536
− "name": "85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
537
− "permissions": [
538
− {
539
− "actions": [
540
− "Microsoft.Compute/galleries/*",
541
− "Microsoft.Compute/locations/capsOperations/read",
542
− "Microsoft.Compute/locations/communityGalleries/*",
543
− "Microsoft.Compute/locations/sharedGalleries/*",
544
− "Microsoft.Compute/images/*",
545
− "Microsoft.Compute/virtualMachines/write",
546
− "Microsoft.Compute/disks/write",
547
− "Microsoft.Authorization/*/read",
548
− "Microsoft.Insights/alertRules/*",
549
− "Microsoft.Resources/deployments/*",
550
− "Microsoft.Resources/subscriptions/resourceGroups/read"
551
− ],
552
− "notActions": [
553
− "Microsoft.Compute/galleries/share/action"
554
− ],
555
− "dataActions": [],
556
− "notDataActions": []
557
− }
558
− ],
559
− "roleName": "Compute Gallery Artifacts Publisher",
560
− "roleType": "BuiltInRole",
561
− "type": "Microsoft.Authorization/roleDefinitions"
562
−}
563
−```
564
−
565
−## Compute Gallery Image Reader
566
−
567
−This is the role for reading gallery images.
568
−
569
−[Learn more](/partner-center/marketplace-offers/azure-vm-use-own-image)
570
−
571
−> [!div class="mx-tableFixed"]
572
−> | Actions | Description |
573
−> | --- | --- |
574
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/images/read | Gets the properties of Gallery Image |
575
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/images/versions/read | Gets the properties of Gallery Image Version |
576
−> | **NotActions** | |
577
−> | *none* | |
578
−> | **DataActions** | |
579
−> | *none* | |
580
−> | **NotDataActions** | |
581
−> | *none* | |
582
−
583
−```json
584
−{
585
− "assignableScopes": [
586
− "/"
587
− ],
588
− "description": "This is the role for reading gallery images.",
589
− "id": "/providers/Microsoft.Authorization/roleDefinitions/cf7c76d2-98a3-4358-a134-615aa78bf44d",
590
− "name": "cf7c76d2-98a3-4358-a134-615aa78bf44d",
591
− "permissions": [
592
− {
593
− "actions": [
594
− "Microsoft.Compute/galleries/images/read",
595
− "Microsoft.Compute/galleries/images/versions/read"
596
− ],
597
− "notActions": [],
598
− "dataActions": [],
599
− "notDataActions": []
600
− }
601
− ],
602
− "roleName": "Compute Gallery Image Reader",
603
− "roleType": "BuiltInRole",
604
− "type": "Microsoft.Authorization/roleDefinitions"
605
−}
606
−```
607
−
608
−## Compute Gallery Sharing Admin
609
−
610
−This role allows user to share gallery to another subscription/tenant or share it to the public.
611
−
612
−[Learn more](/azure/virtual-machines/create-gallery)
613
−
614
−> [!div class="mx-tableFixed"]
615
−> | Actions | Description |
616
−> | --- | --- |
617
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/share/action | Shares a Gallery to different scopes |
618
−> | **NotActions** | |
619
−> | *none* | |
620
−> | **DataActions** | |
621
−> | *none* | |
622
−> | **NotDataActions** | |
623
−> | *none* | |
624
−
625
−```json
626
−{
627
− "assignableScopes": [
628
− "/"
629
− ],
630
− "description": "This role allows user to share gallery to another subscription/tenant or share it to the public.",
631
− "id": "/providers/Microsoft.Authorization/roleDefinitions/1ef6a3be-d0ac-425d-8c01-acb62866290b",
632
− "name": "1ef6a3be-d0ac-425d-8c01-acb62866290b",
633
− "permissions": [
634
− {
635
− "actions": [
636
− "Microsoft.Compute/galleries/share/action"
637
− ],
638
− "notActions": [],
639
− "dataActions": [],
640
− "notDataActions": []
641
− }
642
− ],
643
− "roleName": "Compute Gallery Sharing Admin",
644
− "roleType": "BuiltInRole",
645
− "type": "Microsoft.Authorization/roleDefinitions"
646
−}
647
−```
648
−
649
−## Compute Limit Operator
650
−
651
−Read and manage compute limits using compute limit operations.
652
−
653
−> [!div class="mx-tableFixed"]
654
−> | Actions | Description |
655
−> | --- | --- |
656
−> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/guestSubscriptions/read | Reads guest subscriptions for a given host subscription within a location. |
657
−> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/guestSubscriptions/write | Adds a subscription as a guest to consume a host subscription's shared compute limits. |
658
−> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/guestSubscriptions/delete | Removes a subscription as a guest preventing it from consuming the host subscription's shared compute limits. |
659
−> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/sharedLimits/read | Lists all compute shared limits a host subscription shares with its guest subscriptions. |
660
−> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/sharedLimits/write | Enables sharing of a compute limit by a host subscription with its guest subscriptions. |
661
−> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/locations/sharedLimits/delete | Disables sharing of a compute limit by a host subscription with its guest subscriptions. |
662
−> | [Microsoft.ComputeLimit](../permissions/compute.md#microsoftcomputelimit)/register/action | Registers the subscription for the Compute Limit resource provider and enables the management of compute limit resources. |
663
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
664
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
665
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
666
−> | **NotActions** | |
667
−> | *none* | |
668
−> | **DataActions** | |
669
−> | *none* | |
670
−> | **NotDataActions** | |
671
−> | *none* | |
672
−
673
−```json
674
−{
675
− "assignableScopes": [
676
− "/"
677
− ],
678
− "description": "Read and manage compute limits using compute limit operations.",
679
− "id": "/providers/Microsoft.Authorization/roleDefinitions/980cf6f7-edec-4fd1-8e9e-28f70b1d5258",
680
− "name": "980cf6f7-edec-4fd1-8e9e-28f70b1d5258",
681
− "permissions": [
682
− {
683
− "actions": [
684
− "Microsoft.ComputeLimit/locations/guestSubscriptions/read",
685
− "Microsoft.ComputeLimit/locations/guestSubscriptions/write",
686
− "Microsoft.ComputeLimit/locations/guestSubscriptions/delete",
687
− "Microsoft.ComputeLimit/locations/sharedLimits/read",
688
− "Microsoft.ComputeLimit/locations/sharedLimits/write",
689
− "Microsoft.ComputeLimit/locations/sharedLimits/delete",
690
− "Microsoft.ComputeLimit/register/action",
691
− "Microsoft.Insights/alertRules/*",
692
− "Microsoft.Resources/deployments/*",
693
− "Microsoft.Resources/subscriptions/resourceGroups/read"
694
− ],
695
− "notActions": [],
696
− "dataActions": [],
697
− "notDataActions": []
698
− }
699
− ],
700
− "roleName": "Compute Limit Operator",
701
− "roleType": "BuiltInRole",
702
− "type": "Microsoft.Authorization/roleDefinitions"
703
−}
704
−```
705
−
706
−## Data Operator for Managed Disks
707
−
708
−Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication.
709
−
710
−> [!div class="mx-tableFixed"]
711
−> | Actions | Description |
712
−> | --- | --- |
713
−> | *none* | |
714
−> | **NotActions** | |
715
−> | *none* | |
716
−> | **DataActions** | |
717
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/download/action | Perform read data operations on Disk SAS Uri |
718
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/upload/action | Perform write data operations on Disk SAS Uri |
719
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/snapshots/download/action | Perform read data operations on Snapshot SAS Uri |
720
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/snapshots/upload/action | Perform write data operations on Snapshot SAS Uri |
721
−> | **NotDataActions** | |
722
−> | *none* | |
723
−
724
−```json
725
−{
726
− "assignableScopes": [
727
− "/"
728
− ],
729
− "description": "Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication.",
730
− "id": "/providers/Microsoft.Authorization/roleDefinitions/959f8984-c045-4866-89c7-12bf9737be2e",
731
− "name": "959f8984-c045-4866-89c7-12bf9737be2e",
732
− "permissions": [
733
− {
734
− "actions": [],
735
− "notActions": [],
736
− "dataActions": [
737
− "Microsoft.Compute/disks/download/action",
738
− "Microsoft.Compute/disks/upload/action",
739
− "Microsoft.Compute/snapshots/download/action",
740
− "Microsoft.Compute/snapshots/upload/action"
741
− ],
742
− "notDataActions": []
743
− }
744
− ],
745
− "roleName": "Data Operator for Managed Disks",
746
− "roleType": "BuiltInRole",
747
− "type": "Microsoft.Authorization/roleDefinitions"
748
−}
749
−```
750
−
751
−## Desktop Virtualization Application Group Contributor
752
−
753
−Contributor of the Desktop Virtualization Application Group.
754
−
755
−[Learn more](/azure/virtual-desktop/rbac)
756
−
757
−> [!div class="mx-tableFixed"]
758
−> | Actions | Description |
759
−> | --- | --- |
760
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/applicationgroups/* | |
761
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/read | Read hostpools |
762
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/read | Read hostpools/sessionhosts |
763
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
764
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
765
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
766
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
767
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
768
−> | **NotActions** | |
769
−> | *none* | |
770
−> | **DataActions** | |
771
−> | *none* | |
772
−> | **NotDataActions** | |
773
−> | *none* | |
774
−
775
−```json
776
−{
777
− "assignableScopes": [
778
− "/"
779
− ],
780
− "description": "Contributor of the Desktop Virtualization Application Group.",
781
− "id": "/providers/Microsoft.Authorization/roleDefinitions/86240b0e-9422-4c43-887b-b61143f32ba8",
782
− "name": "86240b0e-9422-4c43-887b-b61143f32ba8",
783
− "permissions": [
784
− {
785
− "actions": [
786
− "Microsoft.DesktopVirtualization/applicationgroups/*",
787
− "Microsoft.DesktopVirtualization/hostpools/read",
788
− "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
789
− "Microsoft.Resources/subscriptions/resourceGroups/read",
790
− "Microsoft.Resources/deployments/*",
791
− "Microsoft.Authorization/*/read",
792
− "Microsoft.Insights/alertRules/*",
793
− "Microsoft.Support/*"
794
− ],
795
− "notActions": [],
796
− "dataActions": [],
797
− "notDataActions": []
798
− }
799
− ],
800
− "roleName": "Desktop Virtualization Application Group Contributor",
801
− "roleType": "BuiltInRole",
802
− "type": "Microsoft.Authorization/roleDefinitions"
803
−}
804
−```
805
−
This commit changed more lines than are kept here; the rest is on GitHub.
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 09:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.