Azure built-in roles · compute
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 906fd2a · +0 −796 lines · also on GitHub
⋯ 6 unchanged lines
77
author: rolyon
88
manager: pmwongera
99
ms.author: rolyon
10
−ms.date: 09/03/2025
11
−ms.custom: generated
12
−---
13
−
14
−# Azure built-in roles for Compute
15
−
16
−This article lists the Azure built-in roles in the Compute category.
17
−
18
−
19
−## Azure Arc VMware VM Contributor
20
−
21
−Arc VMware VM Contributor has permissions to perform all VM actions.
22
−
23
−[Learn more](/azure/azure-arc/vmware-vsphere/setup-and-manage-self-service-access)
24
−
25
−> [!div class="mx-tableFixed"]
26
−> | Actions | Description |
27
−> | --- | --- |
28
−> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/virtualmachines/* | |
29
−> | [Microsoft.ConnectedVMwarevSphere](../permissions/compute.md#microsoftconnectedvmwarevsphere)/virtualmachineinstances/* | |
30
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |
31
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |
32
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |
33
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |
34
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |
35
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |
36
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |
37
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
38
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |
39
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |
40
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/cancel/action | Cancels a deployment. |
41
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates a deployment. |
42
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/whatIf/action | Predicts template deployment changes. |
43
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |
44
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
45
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
46
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/read | Gets or lists deployments. |
47
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/write | Creates or updates an deployment. |
48
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operations/read | Gets or lists deployment operations. |
49
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
50
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
51
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
52
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
53
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
54
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
55
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |
56
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/write | Writes an Azure Arc machines |
57
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/delete | Deletes an Azure Arc machines |
58
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/UpgradeExtensions/action | Upgrades Extensions on Azure Arc machines |
59
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/assessPatches/action | Assesses any Azure Arc machines to get missing software patches |
60
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/installPatches/action | Installs patches on any Azure Arc machines |
61
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/read | Reads any Azure Arc extensions |
62
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/write | Installs or Updates an Azure Arc extensions |
63
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/delete | Deletes an Azure Arc extensions |
64
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/operations/read | Read all Operations for Azure Arc for Servers |
65
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationresults/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |
66
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationstatus/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |
67
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/read | Reads any Azure Arc patchAssessmentResults |
68
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/softwarePatches/read | Reads any Azure Arc patchAssessmentResults/softwarePatches |
69
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/read | Reads any Azure Arc patchInstallationResults |
70
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/softwarePatches/read | Reads any Azure Arc patchInstallationResults/softwarePatches |
71
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/updateCenterOperationResults/read | Reads the status of an update center operation on machines |
72
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/hybridIdentityMetadata/read | Read any Azure Arc machines's Hybrid Identity Metadata |
73
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/read | Read all Azure Connected Machine Agent versions available |
74
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/latest/read | Read the latest Azure Connected Machine Agent version |
75
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/read | Reads any Azure Arc runcommands |
76
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/write | Installs or Updates an Azure Arc runcommands |
77
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/delete | Deletes an Azure Arc runcommands |
78
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/read | Reads any Azure Arc licenseProfiles |
79
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/write | Installs or Updates an Azure Arc licenseProfiles |
80
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/delete | Deletes an Azure Arc licenseProfiles |
81
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/read | Reads any Azure Arc licenses |
82
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/write | Installs or Updates an Azure Arc licenses |
83
−> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/delete | Deletes an Azure Arc licenses |
84
−> | **NotActions** | |
85
−> | *none* | |
86
−> | **DataActions** | |
87
−> | *none* | |
88
−> | **NotDataActions** | |
89
−> | *none* | |
90
−
91
−```json
92
−{
93
− "assignableScopes": [
94
− "/"
95
− ],
96
− "description": "Arc VMware VM Contributor has permissions to perform all VM actions.",
97
− "id": "/providers/Microsoft.Authorization/roleDefinitions/b748a06d-6150-4f8a-aaa9-ce3940cd96cb",
98
− "name": "b748a06d-6150-4f8a-aaa9-ce3940cd96cb",
99
− "permissions": [
100
− {
101
− "actions": [
102
− "Microsoft.ConnectedVMwarevSphere/virtualmachines/*",
103
− "Microsoft.ConnectedVMwarevSphere/virtualmachineinstances/*",
104
− "Microsoft.Insights/AlertRules/Write",
105
− "Microsoft.Insights/AlertRules/Delete",
106
− "Microsoft.Insights/AlertRules/Read",
107
− "Microsoft.Insights/AlertRules/Activated/Action",
108
− "Microsoft.Insights/AlertRules/Resolved/Action",
109
− "Microsoft.Insights/AlertRules/Throttled/Action",
110
− "Microsoft.Insights/AlertRules/Incidents/Read",
111
− "Microsoft.Resources/deployments/read",
112
− "Microsoft.Resources/deployments/write",
113
− "Microsoft.Resources/deployments/delete",
114
− "Microsoft.Resources/deployments/cancel/action",
115
− "Microsoft.Resources/deployments/validate/action",
116
− "Microsoft.Resources/deployments/whatIf/action",
117
− "Microsoft.Resources/deployments/exportTemplate/action",
118
− "Microsoft.Resources/deployments/operations/read",
119
− "Microsoft.Resources/deployments/operationstatuses/read",
120
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
121
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
122
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
123
− "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
124
− "Microsoft.ResourceHealth/availabilityStatuses/read",
125
− "Microsoft.Authorization/*/read",
126
− "Microsoft.Resources/subscriptions/read",
127
− "Microsoft.Resources/subscriptions/resourceGroups/read",
128
− "Microsoft.Resources/subscriptions/operationresults/read",
129
− "Microsoft.HybridCompute/machines/read",
130
− "Microsoft.HybridCompute/machines/write",
131
− "Microsoft.HybridCompute/machines/delete",
132
− "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
133
− "Microsoft.HybridCompute/machines/assessPatches/action",
134
− "Microsoft.HybridCompute/machines/installPatches/action",
135
− "Microsoft.HybridCompute/machines/extensions/read",
136
− "Microsoft.HybridCompute/machines/extensions/write",
137
− "Microsoft.HybridCompute/machines/extensions/delete",
138
− "Microsoft.HybridCompute/operations/read",
139
− "Microsoft.HybridCompute/locations/operationresults/read",
140
− "Microsoft.HybridCompute/locations/operationstatus/read",
141
− "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
142
− "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
143
− "Microsoft.HybridCompute/machines/patchInstallationResults/read",
144
− "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
145
− "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
146
− "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
147
− "Microsoft.HybridCompute/osType/agentVersions/read",
148
− "Microsoft.HybridCompute/osType/agentVersions/latest/read",
149
− "Microsoft.HybridCompute/machines/runcommands/read",
150
− "Microsoft.HybridCompute/machines/runcommands/write",
151
− "Microsoft.HybridCompute/machines/runcommands/delete",
152
− "Microsoft.HybridCompute/machines/licenseProfiles/read",
153
− "Microsoft.HybridCompute/machines/licenseProfiles/write",
154
− "Microsoft.HybridCompute/machines/licenseProfiles/delete",
155
− "Microsoft.HybridCompute/licenses/read",
156
− "Microsoft.HybridCompute/licenses/write",
157
− "Microsoft.HybridCompute/licenses/delete"
158
− ],
159
− "notActions": [],
160
− "dataActions": [],
161
− "notDataActions": []
162
− }
163
− ],
164
− "roleName": "Azure Arc VMware VM Contributor",
165
− "roleType": "BuiltInRole",
166
− "type": "Microsoft.Authorization/roleDefinitions"
167
−}
168
−```
169
−## Azure Batch Account Contributor
170
−
171
−Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.
172
−
173
−[Learn more](/azure/batch/batch-role-based-access-control)
174
−
175
−> [!div class="mx-tableFixed"]
176
−> | Actions | Description |
177
−> | --- | --- |
178
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
179
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/* | Manage all Batch resources. |
180
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
181
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
182
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
183
−> | **NotActions** | |
184
−> | *none* | |
185
−> | **DataActions** | |
186
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/* | Manage all Batch resources. |
187
−> | **NotDataActions** | |
188
−> | *none* | |
189
−
190
−```json
191
−{
192
− "assignableScopes": [
193
− "/"
194
− ],
195
− "description": "Grants full access to manage all Batch resources, including Batch accounts, pools and jobs.",
196
− "id": "/providers/Microsoft.Authorization/roleDefinitions/29fe4964-1e60-436b-bd3a-77fd4c178b3c",
197
− "name": "29fe4964-1e60-436b-bd3a-77fd4c178b3c",
198
− "permissions": [
199
− {
200
− "actions": [
201
− "Microsoft.Authorization/*/read",
202
− "Microsoft.Batch/*",
203
− "Microsoft.Insights/alertRules/*",
204
− "Microsoft.Resources/deployments/*",
205
− "Microsoft.Resources/subscriptions/resourceGroups/read"
206
− ],
207
− "notActions": [],
208
− "dataActions": [
209
− "Microsoft.Batch/*"
210
− ],
211
− "notDataActions": []
212
− }
213
− ],
214
− "roleName": "Azure Batch Account Contributor",
215
− "roleType": "BuiltInRole",
216
− "type": "Microsoft.Authorization/roleDefinitions"
217
−}
218
−```
219
−
220
−## Azure Batch Account Reader
221
−
222
−Lets you view all resources including pools and jobs in the Batch account.
223
−
224
−[Learn more](/azure/batch/batch-role-based-access-control)
225
−
226
−> [!div class="mx-tableFixed"]
227
−> | Actions | Description |
228
−> | --- | --- |
229
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/*/read | View all resources in Batch account. |
230
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
231
−> | **NotActions** | |
232
−> | *none* | |
233
−> | **DataActions** | |
234
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/*/read | View all resources in Batch account. |
235
−> | **NotDataActions** | |
236
−> | *none* | |
237
−
238
−```json
239
−{
240
− "assignableScopes": [
241
− "/"
242
− ],
243
− "description": "Lets you view all resources including pools and jobs in the Batch account.",
244
− "id": "/providers/Microsoft.Authorization/roleDefinitions/11076f67-66f6-4be0-8f6b-f0609fd05cc9",
245
− "name": "11076f67-66f6-4be0-8f6b-f0609fd05cc9",
246
− "permissions": [
247
− {
248
− "actions": [
249
− "Microsoft.Batch/*/read",
250
− "Microsoft.Resources/subscriptions/resourceGroups/read"
251
− ],
252
− "notActions": [],
253
− "dataActions": [
254
− "Microsoft.Batch/*/read"
255
− ],
256
− "notDataActions": []
257
− }
258
− ],
259
− "roleName": "Azure Batch Account Reader",
260
− "roleType": "BuiltInRole",
261
− "type": "Microsoft.Authorization/roleDefinitions"
262
−}
263
−```
264
−
265
−## Azure Batch Data Contributor
266
−
267
−Grants permissions to manage Batch pools and jobs but not to modify accounts.
268
−
269
−[Learn more](/azure/batch/batch-role-based-access-control)
270
−
271
−> [!div class="mx-tableFixed"]
272
−> | Actions | Description |
273
−> | --- | --- |
274
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
275
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/read | Lists Batch accounts or gets the properties of a Batch account |
276
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/applications/* | Create and manage applications and application packages on a Batch account. |
277
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/certificates/* | Create and manage certificates on a Batch account. (Warning: Certificate feature was retired) |
278
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/certificateOperationResults/* | Gets the results of a long running certificate operation on a Batch account. (Warning: Certificate feature was retired) |
279
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/pools/* | Create and manage pools on a Batch account. |
280
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/poolOperationResults/* | Gets the results of a long running pool operation on a Batch account. |
281
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/locations/*/read | Get Batch account operation result/Batch quota/supported VM size at the given location. |
282
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
283
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
284
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
285
−> | **NotActions** | |
286
−> | *none* | |
287
−> | **DataActions** | |
288
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobSchedules/* | Create and manage job schedules on a Batch account. |
289
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobs/* | Create and manage jobs on a Batch account. |
290
−> | **NotDataActions** | |
291
−> | *none* | |
292
−
293
−```json
294
−{
295
− "assignableScopes": [
296
− "/"
297
− ],
298
− "description": "Grants permissions to manage Batch pools and jobs but not to modify accounts.",
299
− "id": "/providers/Microsoft.Authorization/roleDefinitions/6aaa78f1-f7de-44ca-8722-c64a23943cae",
300
− "name": "6aaa78f1-f7de-44ca-8722-c64a23943cae",
301
− "permissions": [
302
− {
303
− "actions": [
304
− "Microsoft.Authorization/*/read",
305
− "Microsoft.Batch/batchAccounts/read",
306
− "Microsoft.Batch/batchAccounts/applications/*",
307
− "Microsoft.Batch/batchAccounts/certificates/*",
308
− "Microsoft.Batch/batchAccounts/certificateOperationResults/*",
309
− "Microsoft.Batch/batchAccounts/pools/*",
310
− "Microsoft.Batch/batchAccounts/poolOperationResults/*",
311
− "Microsoft.Batch/locations/*/read",
312
− "Microsoft.Insights/alertRules/*",
313
− "Microsoft.Resources/deployments/*",
314
− "Microsoft.Resources/subscriptions/resourceGroups/read"
315
− ],
316
− "notActions": [],
317
− "dataActions": [
318
− "Microsoft.Batch/batchAccounts/jobSchedules/*",
319
− "Microsoft.Batch/batchAccounts/jobs/*"
320
− ],
321
− "notDataActions": []
322
− }
323
− ],
324
− "roleName": "Azure Batch Data Contributor",
325
− "roleType": "BuiltInRole",
326
− "type": "Microsoft.Authorization/roleDefinitions"
327
−}
328
−```
329
−
330
−## Azure Batch Job Submitter
331
−
332
−Lets you submit and manage jobs in the Batch account.
333
−
334
−[Learn more](/azure/batch/batch-role-based-access-control)
335
−
336
−> [!div class="mx-tableFixed"]
337
−> | Actions | Description |
338
−> | --- | --- |
339
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/applications/read | Lists applications or gets the properties of an application |
340
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/applications/versions/read | Gets the properties of an application package |
341
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/pools/read | Lists pools on a Batch account or gets the properties of a pool |
342
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
343
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
344
−> | **NotActions** | |
345
−> | *none* | |
346
−> | **DataActions** | |
347
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobSchedules/* | Create and manage job schedules on a Batch account. |
348
−> | [Microsoft.Batch](../permissions/compute.md#microsoftbatch)/batchAccounts/jobs/* | Create and manage jobs on a Batch account. |
349
−> | **NotDataActions** | |
350
−> | *none* | |
351
−
352
−```json
353
−{
354
− "assignableScopes": [
355
− "/"
356
− ],
357
− "description": "Lets you submit and manage jobs in the Batch account.",
358
− "id": "/providers/Microsoft.Authorization/roleDefinitions/48e5e92e-a480-4e71-aa9c-2778f4c13781",
359
− "name": "48e5e92e-a480-4e71-aa9c-2778f4c13781",
360
− "permissions": [
361
− {
362
− "actions": [
363
− "Microsoft.Batch/batchAccounts/applications/read",
364
− "Microsoft.Batch/batchAccounts/applications/versions/read",
365
− "Microsoft.Batch/batchAccounts/pools/read",
366
− "Microsoft.Insights/alertRules/*",
367
− "Microsoft.Resources/subscriptions/resourceGroups/read"
368
− ],
369
− "notActions": [],
370
− "dataActions": [
371
− "Microsoft.Batch/batchAccounts/jobSchedules/*",
372
− "Microsoft.Batch/batchAccounts/jobs/*"
373
− ],
374
− "notDataActions": []
375
− }
376
− ],
377
− "roleName": "Azure Batch Job Submitter",
378
− "roleType": "BuiltInRole",
379
− "type": "Microsoft.Authorization/roleDefinitions"
380
−}
381
−```
382
−
383
−## Classic Virtual Machine Contributor
384
−
385
−Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.
386
−
387
−> [!div class="mx-tableFixed"]
388
−> | Actions | Description |
389
−> | --- | --- |
390
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
391
−> | [Microsoft.ClassicCompute](../permissions/compute.md#microsoftclassiccompute)/domainNames/* | Create and manage classic compute domain names |
392
−> | [Microsoft.ClassicCompute](../permissions/compute.md#microsoftclassiccompute)/virtualMachines/* | Create and manage virtual machines |
393
−> | [Microsoft.ClassicNetwork](../permissions/networking.md#microsoftclassicnetwork)/networkSecurityGroups/join/action | |
394
−> | [Microsoft.ClassicNetwork](../permissions/networking.md#microsoftclassicnetwork)/reservedIps/link/action | Link a reserved Ip |
395
−> | [Microsoft.ClassicNetwork](../permissions/networking.md#microsoftclassicnetwork)/reservedIps/read | Gets the reserved Ips |
396
−> | [Microsoft.ClassicNetwork](../permissions/networking.md#microsoftclassicnetwork)/virtualNetworks/join/action | Joins the virtual network. |
397
−> | [Microsoft.ClassicNetwork](../permissions/networking.md#microsoftclassicnetwork)/virtualNetworks/read | Get the virtual network. |
398
−> | [Microsoft.ClassicStorage](../permissions/storage.md#microsoftclassicstorage)/storageAccounts/disks/read | Returns the storage account disk. |
399
−> | [Microsoft.ClassicStorage](../permissions/storage.md#microsoftclassicstorage)/storageAccounts/images/read | Returns the storage account image. (Deprecated. Use 'Microsoft.ClassicStorage/storageAccounts/vmImages') |
400
−> | [Microsoft.ClassicStorage](../permissions/storage.md#microsoftclassicstorage)/storageAccounts/listKeys/action | Lists the access keys for the storage accounts. |
401
−> | [Microsoft.ClassicStorage](../permissions/storage.md#microsoftclassicstorage)/storageAccounts/read | Return the storage account with the given account. |
402
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
403
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
404
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
405
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
406
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
407
−> | **NotActions** | |
408
−> | *none* | |
409
−> | **DataActions** | |
410
−> | *none* | |
411
−> | **NotDataActions** | |
412
−> | *none* | |
413
−
414
−```json
415
−{
416
− "assignableScopes": [
417
− "/"
418
− ],
419
− "description": "Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.",
420
− "id": "/providers/Microsoft.Authorization/roleDefinitions/d73bb868-a0df-4d4d-bd69-98a00b01fccb",
421
− "name": "d73bb868-a0df-4d4d-bd69-98a00b01fccb",
422
− "permissions": [
423
− {
424
− "actions": [
425
− "Microsoft.Authorization/*/read",
426
− "Microsoft.ClassicCompute/domainNames/*",
427
− "Microsoft.ClassicCompute/virtualMachines/*",
428
− "Microsoft.ClassicNetwork/networkSecurityGroups/join/action",
429
− "Microsoft.ClassicNetwork/reservedIps/link/action",
430
− "Microsoft.ClassicNetwork/reservedIps/read",
431
− "Microsoft.ClassicNetwork/virtualNetworks/join/action",
432
− "Microsoft.ClassicNetwork/virtualNetworks/read",
433
− "Microsoft.ClassicStorage/storageAccounts/disks/read",
434
− "Microsoft.ClassicStorage/storageAccounts/images/read",
435
− "Microsoft.ClassicStorage/storageAccounts/listKeys/action",
436
− "Microsoft.ClassicStorage/storageAccounts/read",
437
− "Microsoft.Insights/alertRules/*",
438
− "Microsoft.ResourceHealth/availabilityStatuses/read",
439
− "Microsoft.Resources/deployments/*",
440
− "Microsoft.Resources/subscriptions/resourceGroups/read",
441
− "Microsoft.Support/*"
442
− ],
443
− "notActions": [],
444
− "dataActions": [],
445
− "notDataActions": []
446
− }
447
− ],
448
− "roleName": "Classic Virtual Machine Contributor",
449
− "roleType": "BuiltInRole",
450
− "type": "Microsoft.Authorization/roleDefinitions"
451
−}
452
−```
453
−
454
−## Compute Fleet Contributor
455
−
456
−Allows users to manage Compute Fleet resources.
457
−
458
−> [!div class="mx-tableFixed"]
459
−> | Actions | Description |
460
−> | --- | --- |
461
−> | [Microsoft.AzureFleet](../permissions/compute.md#microsoftazurefleet)/fleets/* | Create and manage compute fleets |
462
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
463
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
464
−> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
465
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
466
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
467
−> | **NotActions** | |
468
−> | *none* | |
469
−> | **DataActions** | |
470
−> | *none* | |
471
−> | **NotDataActions** | |
472
−> | *none* | |
473
−
474
−```json
475
−{
476
− "assignableScopes": [
477
− "/"
478
− ],
479
− "description": "Allows users to manage Compute Fleet resources.",
480
− "id": "/providers/Microsoft.Authorization/roleDefinitions/2bed379c-9fba-455b-99e4-6b911073bcf2",
481
− "name": "2bed379c-9fba-455b-99e4-6b911073bcf2",
482
− "permissions": [
483
− {
484
− "actions": [
485
− "Microsoft.AzureFleet/fleets/*",
486
− "Microsoft.Authorization/*/read",
487
− "Microsoft.Insights/alertRules/*",
488
− "Microsoft.ResourceHealth/availabilityStatuses/read",
489
− "Microsoft.Resources/deployments/*",
490
− "Microsoft.Resources/subscriptions/resourceGroups/read"
491
− ],
492
− "notActions": [],
493
− "dataActions": [],
494
− "notDataActions": []
495
− }
496
− ],
497
− "roleName": "Compute Fleet Contributor",
498
− "roleType": "BuiltInRole",
499
− "type": "Microsoft.Authorization/roleDefinitions"
500
−}
501
−```
502
−
503
−## Compute Gallery Artifacts Publisher
504
−
505
−This is the role for publishing gallery artifacts.
506
−
507
−> [!div class="mx-tableFixed"]
508
−> | Actions | Description |
509
−> | --- | --- |
510
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/* | |
511
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/capsOperations/read | Gets the status of an asynchronous Caps operation |
512
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/communityGalleries/* | |
513
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/locations/sharedGalleries/* | |
514
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/images/* | |
515
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/write | Creates a new virtual machine or updates an existing virtual machine |
516
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/write | Creates a new Disk or updates an existing one |
517
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
518
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
519
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
520
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
521
−> | **NotActions** | |
522
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/share/action | Shares a Gallery to different scopes |
523
−> | **DataActions** | |
524
−> | *none* | |
525
−> | **NotDataActions** | |
526
−> | *none* | |
527
−
528
−```json
529
−{
530
− "assignableScopes": [
531
− "/"
532
− ],
533
− "description": "This is the role for publishing gallery artifacts.",
534
− "id": "/providers/Microsoft.Authorization/roleDefinitions/85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
535
− "name": "85a2d0d9-2eba-4c9c-b355-11c2cc0788ab",
536
− "permissions": [
537
− {
538
− "actions": [
539
− "Microsoft.Compute/galleries/*",
540
− "Microsoft.Compute/locations/capsOperations/read",
541
− "Microsoft.Compute/locations/communityGalleries/*",
542
− "Microsoft.Compute/locations/sharedGalleries/*",
543
− "Microsoft.Compute/images/*",
544
− "Microsoft.Compute/virtualMachines/write",
545
− "Microsoft.Compute/disks/write",
546
− "Microsoft.Authorization/*/read",
547
− "Microsoft.Insights/alertRules/*",
548
− "Microsoft.Resources/deployments/*",
549
− "Microsoft.Resources/subscriptions/resourceGroups/read"
550
− ],
551
− "notActions": [
552
− "Microsoft.Compute/galleries/share/action"
553
− ],
554
− "dataActions": [],
555
− "notDataActions": []
556
− }
557
− ],
558
− "roleName": "Compute Gallery Artifacts Publisher",
559
− "roleType": "BuiltInRole",
560
− "type": "Microsoft.Authorization/roleDefinitions"
561
−}
562
−```
563
−
564
−## Compute Gallery Image Reader
565
−
566
−This is the role for reading gallery images.
567
−
568
−[Learn more](/partner-center/marketplace-offers/azure-vm-use-own-image)
569
−
570
−> [!div class="mx-tableFixed"]
571
−> | Actions | Description |
572
−> | --- | --- |
573
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/images/read | Gets the properties of Gallery Image |
574
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/images/versions/read | Gets the properties of Gallery Image Version |
575
−> | **NotActions** | |
576
−> | *none* | |
577
−> | **DataActions** | |
578
−> | *none* | |
579
−> | **NotDataActions** | |
580
−> | *none* | |
581
−
582
−```json
583
−{
584
− "assignableScopes": [
585
− "/"
586
− ],
587
− "description": "This is the role for reading gallery images.",
588
− "id": "/providers/Microsoft.Authorization/roleDefinitions/cf7c76d2-98a3-4358-a134-615aa78bf44d",
589
− "name": "cf7c76d2-98a3-4358-a134-615aa78bf44d",
590
− "permissions": [
591
− {
592
− "actions": [
593
− "Microsoft.Compute/galleries/images/read",
594
− "Microsoft.Compute/galleries/images/versions/read"
595
− ],
596
− "notActions": [],
597
− "dataActions": [],
598
− "notDataActions": []
599
− }
600
− ],
601
− "roleName": "Compute Gallery Image Reader",
602
− "roleType": "BuiltInRole",
603
− "type": "Microsoft.Authorization/roleDefinitions"
604
−}
605
−```
606
−
607
−## Compute Gallery Sharing Admin
608
−
609
−This role allows user to share gallery to another subscription/tenant or share it to the public.
610
−
611
−[Learn more](/azure/virtual-machines/create-gallery)
612
−
613
−> [!div class="mx-tableFixed"]
614
−> | Actions | Description |
615
−> | --- | --- |
616
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/galleries/share/action | Shares a Gallery to different scopes |
617
−> | **NotActions** | |
618
−> | *none* | |
619
−> | **DataActions** | |
620
−> | *none* | |
621
−> | **NotDataActions** | |
622
−> | *none* | |
623
−
624
−```json
625
−{
626
− "assignableScopes": [
627
− "/"
628
− ],
629
− "description": "This role allows user to share gallery to another subscription/tenant or share it to the public.",
630
− "id": "/providers/Microsoft.Authorization/roleDefinitions/1ef6a3be-d0ac-425d-8c01-acb62866290b",
631
− "name": "1ef6a3be-d0ac-425d-8c01-acb62866290b",
632
− "permissions": [
633
− {
634
− "actions": [
635
− "Microsoft.Compute/galleries/share/action"
636
− ],
637
− "notActions": [],
638
− "dataActions": [],
639
− "notDataActions": []
640
− }
641
− ],
642
− "roleName": "Compute Gallery Sharing Admin",
643
− "roleType": "BuiltInRole",
644
− "type": "Microsoft.Authorization/roleDefinitions"
645
−}
646
−```
647
−
648
−## Data Operator for Managed Disks
649
−
650
−Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication.
651
−
652
−> [!div class="mx-tableFixed"]
653
−> | Actions | Description |
654
−> | --- | --- |
655
−> | *none* | |
656
−> | **NotActions** | |
657
−> | *none* | |
658
−> | **DataActions** | |
659
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/download/action | Perform read data operations on Disk SAS Uri |
660
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/upload/action | Perform write data operations on Disk SAS Uri |
661
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/snapshots/download/action | Perform read data operations on Snapshot SAS Uri |
662
−> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/snapshots/upload/action | Perform write data operations on Snapshot SAS Uri |
663
−> | **NotDataActions** | |
664
−> | *none* | |
665
−
666
−```json
667
−{
668
− "assignableScopes": [
669
− "/"
670
− ],
671
− "description": "Provides permissions to upload data to empty managed disks, read, or export data of managed disks (not attached to running VMs) and snapshots using SAS URIs and Azure AD authentication.",
672
− "id": "/providers/Microsoft.Authorization/roleDefinitions/959f8984-c045-4866-89c7-12bf9737be2e",
673
− "name": "959f8984-c045-4866-89c7-12bf9737be2e",
674
− "permissions": [
675
− {
676
− "actions": [],
677
− "notActions": [],
678
− "dataActions": [
679
− "Microsoft.Compute/disks/download/action",
680
− "Microsoft.Compute/disks/upload/action",
681
− "Microsoft.Compute/snapshots/download/action",
682
− "Microsoft.Compute/snapshots/upload/action"
683
− ],
684
− "notDataActions": []
685
− }
686
− ],
687
− "roleName": "Data Operator for Managed Disks",
688
− "roleType": "BuiltInRole",
689
− "type": "Microsoft.Authorization/roleDefinitions"
690
−}
691
−```
692
−
693
−## Desktop Virtualization Application Group Contributor
694
−
695
−Contributor of the Desktop Virtualization Application Group.
696
−
697
−[Learn more](/azure/virtual-desktop/rbac)
698
−
699
−> [!div class="mx-tableFixed"]
700
−> | Actions | Description |
701
−> | --- | --- |
702
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/applicationgroups/* | |
703
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/read | Read hostpools |
704
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/read | Read hostpools/sessionhosts |
705
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
706
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
707
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
708
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
709
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
710
−> | **NotActions** | |
711
−> | *none* | |
712
−> | **DataActions** | |
713
−> | *none* | |
714
−> | **NotDataActions** | |
715
−> | *none* | |
716
−
717
−```json
718
−{
719
− "assignableScopes": [
720
− "/"
721
− ],
722
− "description": "Contributor of the Desktop Virtualization Application Group.",
723
− "id": "/providers/Microsoft.Authorization/roleDefinitions/86240b0e-9422-4c43-887b-b61143f32ba8",
724
− "name": "86240b0e-9422-4c43-887b-b61143f32ba8",
725
− "permissions": [
726
− {
727
− "actions": [
728
− "Microsoft.DesktopVirtualization/applicationgroups/*",
729
− "Microsoft.DesktopVirtualization/hostpools/read",
730
− "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
731
− "Microsoft.Resources/subscriptions/resourceGroups/read",
732
− "Microsoft.Resources/deployments/*",
733
− "Microsoft.Authorization/*/read",
734
− "Microsoft.Insights/alertRules/*",
735
− "Microsoft.Support/*"
736
− ],
737
− "notActions": [],
738
− "dataActions": [],
739
− "notDataActions": []
740
− }
741
− ],
742
− "roleName": "Desktop Virtualization Application Group Contributor",
743
− "roleType": "BuiltInRole",
744
− "type": "Microsoft.Authorization/roleDefinitions"
745
−}
746
−```
747
−
748
−## Desktop Virtualization Application Group Reader
749
−
750
−Reader of the Desktop Virtualization Application Group.
751
−
752
−[Learn more](/azure/virtual-desktop/rbac)
753
−
754
−> [!div class="mx-tableFixed"]
755
−> | Actions | Description |
756
−> | --- | --- |
757
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/applicationgroups/*/read | |
758
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/applicationgroups/read | Read applicationgroups |
759
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/read | Read hostpools |
760
−> | [Microsoft.DesktopVirtualization](../permissions/compute.md#microsoftdesktopvirtualization)/hostpools/sessionhosts/read | Read hostpools/sessionhosts |
761
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
762
−> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
763
−> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
764
−> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/read | Read a classic metric alert |
765
−> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
766
−> | **NotActions** | |
767
−> | *none* | |
768
−> | **DataActions** | |
769
−> | *none* | |
770
−> | **NotDataActions** | |
771
−> | *none* | |
772
−
773
−```json
774
−{
775
− "assignableScopes": [
776
− "/"
777
− ],
778
− "description": "Reader of the Desktop Virtualization Application Group.",
779
− "id": "/providers/Microsoft.Authorization/roleDefinitions/aebf23d0-b568-4e86-b8f9-fe83a2c6ab55",
780
− "name": "aebf23d0-b568-4e86-b8f9-fe83a2c6ab55",
781
− "permissions": [
782
− {
783
− "actions": [
784
− "Microsoft.DesktopVirtualization/applicationgroups/*/read",
785
− "Microsoft.DesktopVirtualization/applicationgroups/read",
786
− "Microsoft.DesktopVirtualization/hostpools/read",
787
− "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read",
788
− "Microsoft.Resources/subscriptions/resourceGroups/read",
789
− "Microsoft.Resources/deployments/read",
790
− "Microsoft.Authorization/*/read",
791
− "Microsoft.Insights/alertRules/read",
792
− "Microsoft.Support/*"
793
− ],
794
− "notActions": [],
795
− "dataActions": [],
796
− "notDataActions": []
797
− }
798
− ],
799
− "roleName": "Desktop Virtualization Application Group Reader",
800
− "roleType": "BuiltInRole",
801
− "type": "Microsoft.Authorization/roleDefinitions"
802
−}
803
−```
804
−
805
−## Desktop Virtualization Contributor
This commit changed more lines than are kept here; the rest is on GitHub.
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 09:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.