Azure built-in roles · hybrid multicloud
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 3d287f2 · +514 −0 lines · also on GitHub
⋯ 15 unchanged lines
1616
This article lists the Azure built-in roles in the Hybrid + multicloud category (Azure Stack HCI).
1717
1818
19
+## Azure Arc ScVmm Administrator role
20
+
21
+Arc ScVmm VM Administrator has permissions to perform all ScVmm actions.
22
+
23
+[Learn more](/azure/azure-arc/system-center-virtual-machine-manager/built-in-roles)
24
+
25
+> [!div class="mx-tableFixed"]
26
+> | Actions | Description |
27
+> | --- | --- |
28
+> | [Microsoft.ScVmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/* | |
29
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |
30
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |
31
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |
32
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |
33
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |
34
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |
35
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |
36
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
37
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |
38
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |
39
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/cancel/action | Cancels a deployment. |
40
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates a deployment. |
41
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/whatIf/action | Predicts template deployment changes. |
42
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |
43
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
44
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
45
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/read | Gets or lists deployments. |
46
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/write | Creates or updates an deployment. |
47
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operations/read | Gets or lists deployment operations. |
48
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
49
+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
50
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
51
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
52
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
53
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
54
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/Read | Gets an Custom Location resource |
55
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
56
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |
57
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/write | Writes an Azure Arc machines |
58
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/delete | Deletes an Azure Arc machines |
59
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/UpgradeExtensions/action | Upgrades Extensions on Azure Arc machines |
60
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/assessPatches/action | Assesses any Azure Arc machines to get missing software patches |
61
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/installPatches/action | Installs patches on any Azure Arc machines |
62
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/read | Reads any Azure Arc extensions |
63
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/write | Installs or Updates an Azure Arc extensions |
64
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/delete | Deletes an Azure Arc extensions |
65
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/operations/read | Read all Operations for Azure Arc for Servers |
66
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationresults/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |
67
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationstatus/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |
68
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/read | Reads any Azure Arc patchAssessmentResults |
69
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/softwarePatches/read | Reads any Azure Arc patchAssessmentResults/softwarePatches |
70
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/read | Reads any Azure Arc patchInstallationResults |
71
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/softwarePatches/read | Reads any Azure Arc patchInstallationResults/softwarePatches |
72
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/updateCenterOperationResults/read | Reads the status of an update center operation on machines |
73
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/hybridIdentityMetadata/read | Read any Azure Arc machines's Hybrid Identity Metadata |
74
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/read | Read all Azure Connected Machine Agent versions available |
75
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/latest/read | Read the latest Azure Connected Machine Agent version |
76
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/read | Reads any Azure Arc runcommands |
77
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/write | Installs or Updates an Azure Arc runcommands |
78
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/delete | Deletes an Azure Arc runcommands |
79
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/read | Reads any Azure Arc licenseProfiles |
80
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/write | Installs or Updates an Azure Arc licenseProfiles |
81
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/delete | Deletes an Azure Arc licenseProfiles |
82
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/read | Reads any Azure Arc licenses |
83
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/write | Installs or Updates an Azure Arc licenses |
84
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/delete | Deletes an Azure Arc licenses |
85
+> | **NotActions** | |
86
+> | *none* | |
87
+> | **DataActions** | |
88
+> | *none* | |
89
+> | **NotDataActions** | |
90
+> | *none* | |
91
+
92
+```json
93
+{
94
+ "assignableScopes": [
95
+ "/"
96
+ ],
97
+ "description": "Arc ScVmm VM Administrator has permissions to perform all ScVmm actions.",
98
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/a92dfd61-77f9-4aec-a531-19858b406c87",
99
+ "name": "a92dfd61-77f9-4aec-a531-19858b406c87",
100
+ "permissions": [
101
+ {
102
+ "actions": [
103
+ "Microsoft.ScVmm/*",
104
+ "Microsoft.Insights/AlertRules/Write",
105
+ "Microsoft.Insights/AlertRules/Delete",
106
+ "Microsoft.Insights/AlertRules/Read",
107
+ "Microsoft.Insights/AlertRules/Activated/Action",
108
+ "Microsoft.Insights/AlertRules/Resolved/Action",
109
+ "Microsoft.Insights/AlertRules/Throttled/Action",
110
+ "Microsoft.Insights/AlertRules/Incidents/Read",
111
+ "Microsoft.Resources/deployments/read",
112
+ "Microsoft.Resources/deployments/write",
113
+ "Microsoft.Resources/deployments/delete",
114
+ "Microsoft.Resources/deployments/cancel/action",
115
+ "Microsoft.Resources/deployments/validate/action",
116
+ "Microsoft.Resources/deployments/whatIf/action",
117
+ "Microsoft.Resources/deployments/exportTemplate/action",
118
+ "Microsoft.Resources/deployments/operations/read",
119
+ "Microsoft.Resources/deployments/operationstatuses/read",
120
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
121
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
122
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
123
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
124
+ "Microsoft.ResourceHealth/availabilityStatuses/read",
125
+ "Microsoft.Authorization/*/read",
126
+ "Microsoft.Resources/subscriptions/read",
127
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
128
+ "Microsoft.Resources/subscriptions/operationresults/read",
129
+ "Microsoft.ExtendedLocation/customLocations/Read",
130
+ "Microsoft.ExtendedLocation/customLocations/deploy/action",
131
+ "Microsoft.HybridCompute/machines/read",
132
+ "Microsoft.HybridCompute/machines/write",
133
+ "Microsoft.HybridCompute/machines/delete",
134
+ "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
135
+ "Microsoft.HybridCompute/machines/assessPatches/action",
136
+ "Microsoft.HybridCompute/machines/installPatches/action",
137
+ "Microsoft.HybridCompute/machines/extensions/read",
138
+ "Microsoft.HybridCompute/machines/extensions/write",
139
+ "Microsoft.HybridCompute/machines/extensions/delete",
140
+ "Microsoft.HybridCompute/operations/read",
141
+ "Microsoft.HybridCompute/locations/operationresults/read",
142
+ "Microsoft.HybridCompute/locations/operationstatus/read",
143
+ "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
144
+ "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
145
+ "Microsoft.HybridCompute/machines/patchInstallationResults/read",
146
+ "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
147
+ "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
148
+ "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
149
+ "Microsoft.HybridCompute/osType/agentVersions/read",
150
+ "Microsoft.HybridCompute/osType/agentVersions/latest/read",
151
+ "Microsoft.HybridCompute/machines/runcommands/read",
152
+ "Microsoft.HybridCompute/machines/runcommands/write",
153
+ "Microsoft.HybridCompute/machines/runcommands/delete",
154
+ "Microsoft.HybridCompute/machines/licenseProfiles/read",
155
+ "Microsoft.HybridCompute/machines/licenseProfiles/write",
156
+ "Microsoft.HybridCompute/machines/licenseProfiles/delete",
157
+ "Microsoft.HybridCompute/licenses/read",
158
+ "Microsoft.HybridCompute/licenses/write",
159
+ "Microsoft.HybridCompute/licenses/delete"
160
+ ],
161
+ "notActions": [],
162
+ "dataActions": [],
163
+ "notDataActions": []
164
+ }
165
+ ],
166
+ "roleName": "Azure Arc ScVmm Administrator role",
167
+ "roleType": "BuiltInRole",
168
+ "type": "Microsoft.Authorization/roleDefinitions"
169
+}
170
+```
171
+
172
+## Azure Arc ScVmm Private Cloud User
173
+
174
+Azure Arc ScVmm Private Cloud User has permissions to use the ScVmm resources to deploy VMs.
175
+
176
+[Learn more](/azure/azure-arc/system-center-virtual-machine-manager/built-in-roles)
177
+
178
+> [!div class="mx-tableFixed"]
179
+> | Actions | Description |
180
+> | --- | --- |
181
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |
182
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |
183
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |
184
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |
185
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |
186
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |
187
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |
188
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
189
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |
190
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |
191
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/cancel/action | Cancels a deployment. |
192
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates a deployment. |
193
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/whatIf/action | Predicts template deployment changes. |
194
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |
195
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
196
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
197
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/read | Gets or lists deployments. |
198
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/write | Creates or updates an deployment. |
199
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operations/read | Gets or lists deployment operations. |
200
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
201
+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
202
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
203
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
204
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
205
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
206
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/virtualnetworks/join/action | Join virtual network. |
207
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/virtualnetworks/Read | Read virtualnetworks |
208
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/virtualmachinetemplates/clone/action | Clones virtualmachinetemplates |
209
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/virtualmachinetemplates/Read | Read virtualmachinetemplates |
210
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/clouds/deploy/action | Deploy on resource pool. |
211
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/clouds/Read | Read clouds |
212
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/Read | Gets an Custom Location resource |
213
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
214
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/enabledresourcetypes/read | Gets EnabledResourceTypes for a Custom Location resource |
215
+> | **NotActions** | |
216
+> | *none* | |
217
+> | **DataActions** | |
218
+> | *none* | |
219
+> | **NotDataActions** | |
220
+> | *none* | |
221
+
222
+```json
223
+{
224
+ "assignableScopes": [
225
+ "/"
226
+ ],
227
+ "description": "Azure Arc ScVmm Private Cloud User has permissions to use the ScVmm resources to deploy VMs.",
228
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/c0781e91-8102-4553-8951-97c6d4243cda",
229
+ "name": "c0781e91-8102-4553-8951-97c6d4243cda",
230
+ "permissions": [
231
+ {
232
+ "actions": [
233
+ "Microsoft.Insights/AlertRules/Write",
234
+ "Microsoft.Insights/AlertRules/Delete",
235
+ "Microsoft.Insights/AlertRules/Read",
236
+ "Microsoft.Insights/AlertRules/Activated/Action",
237
+ "Microsoft.Insights/AlertRules/Resolved/Action",
238
+ "Microsoft.Insights/AlertRules/Throttled/Action",
239
+ "Microsoft.Insights/AlertRules/Incidents/Read",
240
+ "Microsoft.Resources/deployments/read",
241
+ "Microsoft.Resources/deployments/write",
242
+ "Microsoft.Resources/deployments/delete",
243
+ "Microsoft.Resources/deployments/cancel/action",
244
+ "Microsoft.Resources/deployments/validate/action",
245
+ "Microsoft.Resources/deployments/whatIf/action",
246
+ "Microsoft.Resources/deployments/exportTemplate/action",
247
+ "Microsoft.Resources/deployments/operations/read",
248
+ "Microsoft.Resources/deployments/operationstatuses/read",
249
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
250
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
251
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
252
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
253
+ "Microsoft.ResourceHealth/availabilityStatuses/read",
254
+ "Microsoft.Authorization/*/read",
255
+ "Microsoft.Resources/subscriptions/read",
256
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
257
+ "Microsoft.Resources/subscriptions/operationresults/read",
258
+ "microsoft.scvmm/virtualnetworks/join/action",
259
+ "microsoft.scvmm/virtualnetworks/Read",
260
+ "microsoft.scvmm/virtualmachinetemplates/clone/action",
261
+ "microsoft.scvmm/virtualmachinetemplates/Read",
262
+ "microsoft.scvmm/clouds/deploy/action",
263
+ "microsoft.scvmm/clouds/Read",
264
+ "Microsoft.ExtendedLocation/customLocations/Read",
265
+ "Microsoft.ExtendedLocation/customLocations/deploy/action",
266
+ "Microsoft.ExtendedLocation/customLocations/enabledresourcetypes/read"
267
+ ],
268
+ "notActions": [],
269
+ "dataActions": [],
270
+ "notDataActions": []
271
+ }
272
+ ],
273
+ "roleName": "Azure Arc ScVmm Private Cloud User",
274
+ "roleType": "BuiltInRole",
275
+ "type": "Microsoft.Authorization/roleDefinitions"
276
+}
277
+```
278
+
279
+## Azure Arc ScVmm Private Clouds Onboarding
280
+
281
+Azure Arc ScVmm Private Clouds Onboarding role has permissions to provision all the required resources for onboard and deboard vmm server instances to Azure.
282
+
283
+[Learn more](/azure/azure-arc/system-center-virtual-machine-manager/built-in-roles)
284
+
285
+> [!div class="mx-tableFixed"]
286
+> | Actions | Description |
287
+> | --- | --- |
288
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/vmmservers/Read | Read vmmservers |
289
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/vmmservers/Write | Writes vmmservers |
290
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/vmmservers/Delete | Deletes vmmservers |
291
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |
292
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |
293
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |
294
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |
295
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |
296
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |
297
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |
298
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
299
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |
300
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |
301
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/cancel/action | Cancels a deployment. |
302
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates a deployment. |
303
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/whatIf/action | Predicts template deployment changes. |
304
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |
305
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
306
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
307
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/read | Gets or lists deployments. |
308
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/write | Creates or updates an deployment. |
309
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operations/read | Gets or lists deployment operations. |
310
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
311
+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
312
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
313
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
314
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
315
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
316
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/Read | Gets an Custom Location resource |
317
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
318
+> | **NotActions** | |
319
+> | *none* | |
320
+> | **DataActions** | |
321
+> | *none* | |
322
+> | **NotDataActions** | |
323
+> | *none* | |
324
+
325
+```json
326
+{
327
+ "assignableScopes": [
328
+ "/"
329
+ ],
330
+ "description": "Azure Arc ScVmm Private Clouds Onboarding role has permissions to provision all the required resources for onboard and deboard vmm server instances to Azure.",
331
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/6aac74c4-6311-40d2-bbdd-7d01e7c6e3a9",
332
+ "name": "6aac74c4-6311-40d2-bbdd-7d01e7c6e3a9",
333
+ "permissions": [
334
+ {
335
+ "actions": [
336
+ "microsoft.scvmm/vmmservers/Read",
337
+ "microsoft.scvmm/vmmservers/Write",
338
+ "microsoft.scvmm/vmmservers/Delete",
339
+ "Microsoft.Insights/AlertRules/Write",
340
+ "Microsoft.Insights/AlertRules/Delete",
341
+ "Microsoft.Insights/AlertRules/Read",
342
+ "Microsoft.Insights/AlertRules/Activated/Action",
343
+ "Microsoft.Insights/AlertRules/Resolved/Action",
344
+ "Microsoft.Insights/AlertRules/Throttled/Action",
345
+ "Microsoft.Insights/AlertRules/Incidents/Read",
346
+ "Microsoft.Resources/deployments/read",
347
+ "Microsoft.Resources/deployments/write",
348
+ "Microsoft.Resources/deployments/delete",
349
+ "Microsoft.Resources/deployments/cancel/action",
350
+ "Microsoft.Resources/deployments/validate/action",
351
+ "Microsoft.Resources/deployments/whatIf/action",
352
+ "Microsoft.Resources/deployments/exportTemplate/action",
353
+ "Microsoft.Resources/deployments/operations/read",
354
+ "Microsoft.Resources/deployments/operationstatuses/read",
355
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
356
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
357
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
358
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
359
+ "Microsoft.ResourceHealth/availabilityStatuses/read",
360
+ "Microsoft.Authorization/*/read",
361
+ "Microsoft.Resources/subscriptions/read",
362
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
363
+ "Microsoft.Resources/subscriptions/operationresults/read",
364
+ "Microsoft.ExtendedLocation/customLocations/Read",
365
+ "Microsoft.ExtendedLocation/customLocations/deploy/action"
366
+ ],
367
+ "notActions": [],
368
+ "dataActions": [],
369
+ "notDataActions": []
370
+ }
371
+ ],
372
+ "roleName": "Azure Arc ScVmm Private Clouds Onboarding",
373
+ "roleType": "BuiltInRole",
374
+ "type": "Microsoft.Authorization/roleDefinitions"
375
+}
376
+```
377
+
378
+## Azure Arc ScVmm VM Contributor
379
+
380
+Arc ScVmm VM Contributor has permissions to perform all VM actions.
381
+
382
+[Learn more](/azure/azure-arc/system-center-virtual-machine-manager/built-in-roles)
383
+
384
+> [!div class="mx-tableFixed"]
385
+> | Actions | Description |
386
+> | --- | --- |
387
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/virtualmachines/* | |
388
+> | [microsoft.scvmm](../permissions/hybrid-multicloud.md#microsoftscvmm)/virtualMachineInstances/* | |
389
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Write | Create or update a classic metric alert |
390
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Delete | Delete a classic metric alert |
391
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Read | Read a classic metric alert |
392
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Activated/Action | Classic metric alert activated |
393
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Resolved/Action | Classic metric alert resolved |
394
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Throttled/Action | Classic metric alert rule throttled |
395
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/AlertRules/Incidents/Read | Read a classic metric alert incident |
396
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/read | Gets or lists deployments. |
397
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |
398
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/delete | Deletes a deployment. |
399
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/cancel/action | Cancels a deployment. |
400
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/validate/action | Validates a deployment. |
401
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/whatIf/action | Predicts template deployment changes. |
402
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/exportTemplate/action | Export template for a deployment |
403
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operations/read | Gets or lists deployment operations. |
404
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
405
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/read | Gets or lists deployments. |
406
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/write | Creates or updates an deployment. |
407
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operations/read | Gets or lists deployment operations. |
408
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/operationstatuses/read | Gets or lists deployment operation statuses. |
409
+> | [Microsoft.ResourceHealth](../permissions/management-and-governance.md#microsoftresourcehealth)/availabilityStatuses/read | Gets the availability statuses for all resources in the specified scope |
410
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
411
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
412
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
413
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |
414
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/Read | Gets an Custom Location resource |
415
+> | [Microsoft.ExtendedLocation](../permissions/hybrid-multicloud.md#microsoftextendedlocation)/customLocations/deploy/action | Deploy permissions to a Custom Location resource |
416
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |
417
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/write | Writes an Azure Arc machines |
418
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/delete | Deletes an Azure Arc machines |
419
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/UpgradeExtensions/action | Upgrades Extensions on Azure Arc machines |
420
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/assessPatches/action | Assesses any Azure Arc machines to get missing software patches |
421
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/installPatches/action | Installs patches on any Azure Arc machines |
422
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/read | Reads any Azure Arc extensions |
423
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/write | Installs or Updates an Azure Arc extensions |
424
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/delete | Deletes an Azure Arc extensions |
425
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/operations/read | Read all Operations for Azure Arc for Servers |
426
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationresults/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |
427
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/operationstatus/read | Reads the status of an operation on Microsoft.HybridCompute Resource Provider |
428
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/read | Reads any Azure Arc patchAssessmentResults |
429
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchAssessmentResults/softwarePatches/read | Reads any Azure Arc patchAssessmentResults/softwarePatches |
430
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/read | Reads any Azure Arc patchInstallationResults |
431
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/patchInstallationResults/softwarePatches/read | Reads any Azure Arc patchInstallationResults/softwarePatches |
432
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/locations/updateCenterOperationResults/read | Reads the status of an update center operation on machines |
433
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/hybridIdentityMetadata/read | Read any Azure Arc machines's Hybrid Identity Metadata |
434
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/read | Read all Azure Connected Machine Agent versions available |
435
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/osType/agentVersions/latest/read | Read the latest Azure Connected Machine Agent version |
436
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/read | Reads any Azure Arc runcommands |
437
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/write | Installs or Updates an Azure Arc runcommands |
438
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/runcommands/delete | Deletes an Azure Arc runcommands |
439
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/read | Reads any Azure Arc licenseProfiles |
440
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/write | Installs or Updates an Azure Arc licenseProfiles |
441
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/licenseProfiles/delete | Deletes an Azure Arc licenseProfiles |
442
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/read | Reads any Azure Arc licenses |
443
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/write | Installs or Updates an Azure Arc licenses |
444
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/licenses/delete | Deletes an Azure Arc licenses |
445
+> | **NotActions** | |
446
+> | *none* | |
447
+> | **DataActions** | |
448
+> | *none* | |
449
+> | **NotDataActions** | |
450
+> | *none* | |
451
+
452
+```json
453
+{
454
+ "assignableScopes": [
455
+ "/"
456
+ ],
457
+ "description": "Arc ScVmm VM Contributor has permissions to perform all VM actions.",
458
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/e582369a-e17b-42a5-b10c-874c387c530b",
459
+ "name": "e582369a-e17b-42a5-b10c-874c387c530b",
460
+ "permissions": [
461
+ {
462
+ "actions": [
463
+ "microsoft.scvmm/virtualmachines/*",
464
+ "microsoft.scvmm/virtualMachineInstances/*",
465
+ "Microsoft.Insights/AlertRules/Write",
466
+ "Microsoft.Insights/AlertRules/Delete",
467
+ "Microsoft.Insights/AlertRules/Read",
468
+ "Microsoft.Insights/AlertRules/Activated/Action",
469
+ "Microsoft.Insights/AlertRules/Resolved/Action",
470
+ "Microsoft.Insights/AlertRules/Throttled/Action",
471
+ "Microsoft.Insights/AlertRules/Incidents/Read",
472
+ "Microsoft.Resources/deployments/read",
473
+ "Microsoft.Resources/deployments/write",
474
+ "Microsoft.Resources/deployments/delete",
475
+ "Microsoft.Resources/deployments/cancel/action",
476
+ "Microsoft.Resources/deployments/validate/action",
477
+ "Microsoft.Resources/deployments/whatIf/action",
478
+ "Microsoft.Resources/deployments/exportTemplate/action",
479
+ "Microsoft.Resources/deployments/operations/read",
480
+ "Microsoft.Resources/deployments/operationstatuses/read",
481
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
482
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/write",
483
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
484
+ "Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
485
+ "Microsoft.ResourceHealth/availabilityStatuses/read",
486
+ "Microsoft.Authorization/*/read",
487
+ "Microsoft.Resources/subscriptions/read",
488
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
489
+ "Microsoft.Resources/subscriptions/operationresults/read",
490
+ "Microsoft.ExtendedLocation/customLocations/Read",
491
+ "Microsoft.ExtendedLocation/customLocations/deploy/action",
492
+ "Microsoft.HybridCompute/machines/read",
493
+ "Microsoft.HybridCompute/machines/write",
494
+ "Microsoft.HybridCompute/machines/delete",
495
+ "Microsoft.HybridCompute/machines/UpgradeExtensions/action",
496
+ "Microsoft.HybridCompute/machines/assessPatches/action",
497
+ "Microsoft.HybridCompute/machines/installPatches/action",
498
+ "Microsoft.HybridCompute/machines/extensions/read",
499
+ "Microsoft.HybridCompute/machines/extensions/write",
500
+ "Microsoft.HybridCompute/machines/extensions/delete",
501
+ "Microsoft.HybridCompute/operations/read",
502
+ "Microsoft.HybridCompute/locations/operationresults/read",
503
+ "Microsoft.HybridCompute/locations/operationstatus/read",
504
+ "Microsoft.HybridCompute/machines/patchAssessmentResults/read",
505
+ "Microsoft.HybridCompute/machines/patchAssessmentResults/softwarePatches/read",
506
+ "Microsoft.HybridCompute/machines/patchInstallationResults/read",
507
+ "Microsoft.HybridCompute/machines/patchInstallationResults/softwarePatches/read",
508
+ "Microsoft.HybridCompute/locations/updateCenterOperationResults/read",
509
+ "Microsoft.HybridCompute/machines/hybridIdentityMetadata/read",
510
+ "Microsoft.HybridCompute/osType/agentVersions/read",
511
+ "Microsoft.HybridCompute/osType/agentVersions/latest/read",
512
+ "Microsoft.HybridCompute/machines/runcommands/read",
513
+ "Microsoft.HybridCompute/machines/runcommands/write",
514
+ "Microsoft.HybridCompute/machines/runcommands/delete",
515
+ "Microsoft.HybridCompute/machines/licenseProfiles/read",
516
+ "Microsoft.HybridCompute/machines/licenseProfiles/write",
517
+ "Microsoft.HybridCompute/machines/licenseProfiles/delete",
518
+ "Microsoft.HybridCompute/licenses/read",
519
+ "Microsoft.HybridCompute/licenses/write",
520
+ "Microsoft.HybridCompute/licenses/delete"
521
+ ],
522
+ "notActions": [],
523
+ "dataActions": [],
524
+ "notDataActions": []
525
+ }
526
+ ],
527
+ "roleName": "Azure Arc ScVmm VM Contributor",
528
+ "roleType": "BuiltInRole",
529
+ "type": "Microsoft.Authorization/roleDefinitions"
530
+}
531
+```
532
+
19533
## Azure Resource Bridge Deployment Role
20534
21535
> [!IMPORTANT]
⋯ 923 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 09:55 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.