Azure built-in roles · migration
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/azure-docs · commit 906fd2a · +514 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Azure built-in roles for Migration - Azure RBAC
3
+description: This article lists the Azure built-in roles for Azure role-based access control (Azure RBAC) in the Migration category. It lists Actions, NotActions, DataActions, and NotDataActions.
4
+ms.service: role-based-access-control
5
+ms.topic: generated-reference
6
+ms.workload: identity
7
+author: rolyon
8
+manager: pmwongera
9
+ms.author: rolyon
10
+ms.date: 12/31/2025
11
+ms.custom: generated
12
+---
13
+
14
+# Azure built-in roles for Migration
15
+
16
+This article lists the Azure built-in roles in the Migration category.
17
+
18
+
19
+## Azure Migrate Decide and Plan Expert
20
+
21
+Grants restricted access on Azure Migrate project to only perform planning operations including appliance-based discovery, managing inventory, identifying server dependencies, creation of business case & assessment reports.
22
+
23
+[Learn more](/azure/migrate/prepare-azure-accounts)
24
+
25
+> [!div class="mx-tableFixed"]
26
+> | Actions | Description |
27
+> | --- | --- |
28
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
29
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
30
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
31
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/locations/read | Gets the list of locations supported. |
32
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/checkResourceName/action | Check the resource name for validity. |
33
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/write | Creates or updates a deployment script |
34
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/read | Gets or lists deployment scripts |
35
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/write | Creates or updates a resource link. |
36
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
37
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/write | Add locks at the specified scope. |
38
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/delete | Delete locks at the specified scope. |
39
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
40
+> | [Microsoft.Migrate](../permissions/migration.md#microsoftmigrate)/* | |
41
+> | Microsoft.ApplicationMigration/* | |
42
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/* | |
43
+> | Microsoft.MySQLDiscovery/* | |
44
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
45
+> | Microsoft.DependencyMap/* | |
46
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/* | |
47
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/checkNameAvailability/read | Checks that a key vault name is valid and is not in use |
48
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |
49
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/write | Writes an Azure Arc machines |
50
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/delete | Deletes an Azure Arc machines |
51
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/register/action | Registers the subscription for the Microsoft.HybridCompute Resource Provider |
52
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/write | Creates a virtual network subnet or updates an existing virtual network subnet |
53
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/join/action | Joins a virtual network. Not Alertable. |
54
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/join/action | Joins a network security group. Not Alertable. |
55
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/join/action | Joins a virtual network. Not Alertable. |
56
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/read | Gets an private endpoint resource. |
57
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/write | Creates a new private endpoint, or updates an existing private endpoint. |
58
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/privateDnsZoneGroups/write | Puts a Private DNS Zone Group |
59
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/write | Create or update a Private DNS zone within a resource group. Note that this command cannot be used to create or update virtual network links or record sets within the zone. |
60
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/virtualNetworkLinks/write | Create or update a Private DNS zone link to virtual network. |
61
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/join/action | Joins a Private DNS Zone |
62
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/A/write | Create or update a record set of type 'A' within a Private DNS zone. The records specified will replace the current records in the record set. |
63
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/register/action | Registers the subscription |
64
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
65
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/privateDnsZoneGroups/read | Gets a Private DNS Zone Group |
66
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/*/read | |
67
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/*/write | |
68
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/listKeys/action | Returns the access keys for the specified storage account. |
69
+> | [Microsoft.GuestConfiguration](../permissions/management-and-governance.md#microsoftguestconfiguration)/register/action | Registers the subscription for the Microsoft.GuestConfiguration resource provider. |
70
+> | [Microsoft.HybridConnectivity](../permissions/hybrid-multicloud.md#microsofthybridconnectivity)/register/action | Register the subscription for Microsoft.HybridConnectivity |
71
+> | Microsoft.DataReplication/*/read | |
72
+> | Microsoft.DataReplication/register/action | Registers the subscription for the Microsoft.DataReplication resource provider |
73
+> | Microsoft.DataReplication/replicationVaults/write | Updates any vault |
74
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/vaults/* | |
75
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/register/action | Registers subscription for given Resource Provider |
76
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/register/action | Registers a subscription |
77
+> | Microsoft.AzureArcData/register/action | Register the subscription for Microsoft.AzureArcData |
78
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/read | Gets or lists resource links. |
79
+> | **NotActions** | |
80
+> | *none* | |
81
+> | **DataActions** | |
82
+> | *none* | |
83
+> | **NotDataActions** | |
84
+> | *none* | |
85
+
86
+```json
87
+{
88
+ "assignableScopes": [
89
+ "/"
90
+ ],
91
+ "description": "Grants restricted access on Azure Migrate project to only perform planning operations including appliance-based discovery, managing inventory, identifying server dependencies, creation of business case & assessment reports.",
92
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/7859c0b0-0bb9-4994-bd12-cd529af7d646",
93
+ "name": "7859c0b0-0bb9-4994-bd12-cd529af7d646",
94
+ "permissions": [
95
+ {
96
+ "actions": [
97
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
98
+ "Microsoft.Resources/subscriptions/read",
99
+ "Microsoft.Resources/deployments/*",
100
+ "Microsoft.Resources/subscriptions/locations/read",
101
+ "Microsoft.Resources/checkResourceName/action",
102
+ "Microsoft.Resources/deploymentScripts/write",
103
+ "Microsoft.Resources/deploymentScripts/read",
104
+ "Microsoft.Resources/links/write",
105
+ "Microsoft.Authorization/*/read",
106
+ "Microsoft.Authorization/locks/write",
107
+ "Microsoft.Authorization/locks/delete",
108
+ "Microsoft.Insights/alertRules/*",
109
+ "Microsoft.Migrate/*",
110
+ "Microsoft.ApplicationMigration/*",
111
+ "Microsoft.OffAzure/*",
112
+ "Microsoft.MySQLDiscovery/*",
113
+ "Microsoft.Support/*",
114
+ "Microsoft.DependencyMap/*",
115
+ "Microsoft.KeyVault/vaults/*",
116
+ "Microsoft.KeyVault/checkNameAvailability/read",
117
+ "Microsoft.HybridCompute/machines/read",
118
+ "Microsoft.HybridCompute/machines/write",
119
+ "Microsoft.HybridCompute/machines/delete",
120
+ "Microsoft.HybridCompute/register/action",
121
+ "Microsoft.Network/virtualNetworks/subnets/write",
122
+ "Microsoft.Network/virtualNetworks/subnets/join/action",
123
+ "Microsoft.Network/networkSecurityGroups/join/action",
124
+ "Microsoft.Network/virtualNetworks/join/action",
125
+ "Microsoft.Network/privateEndpoints/read",
126
+ "Microsoft.Network/privateEndpoints/write",
127
+ "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
128
+ "Microsoft.Network/privateDnsZones/write",
129
+ "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
130
+ "Microsoft.Network/privateDnsZones/join/action",
131
+ "Microsoft.Network/privateDnsZones/A/write",
132
+ "Microsoft.Network/register/action",
133
+ "Microsoft.Network/virtualNetworks/subnets/read",
134
+ "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
135
+ "Microsoft.Storage/storageAccounts/*/read",
136
+ "Microsoft.Storage/storageAccounts/*/write",
137
+ "Microsoft.Storage/storageAccounts/listKeys/action",
138
+ "Microsoft.GuestConfiguration/register/action",
139
+ "Microsoft.HybridConnectivity/register/action",
140
+ "Microsoft.DataReplication/*/read",
141
+ "Microsoft.DataReplication/register/action",
142
+ "Microsoft.DataReplication/replicationVaults/write",
143
+ "Microsoft.RecoveryServices/vaults/*",
144
+ "Microsoft.RecoveryServices/register/action",
145
+ "Microsoft.KeyVault/register/action",
146
+ "Microsoft.AzureArcData/register/action",
147
+ "Microsoft.Resources/links/read"
148
+ ],
149
+ "notActions": [],
150
+ "dataActions": [],
151
+ "notDataActions": []
152
+ }
153
+ ],
154
+ "roleName": "Azure Migrate Decide and Plan Expert",
155
+ "roleType": "BuiltInRole",
156
+ "type": "Microsoft.Authorization/roleDefinitions"
157
+}
158
+```
159
+
160
+## Azure Migrate Execute Expert
161
+
162
+Grants restricted access on an Azure Migrate project to only perform migration related operations, including replication, execution of test migrations, tracking and monitoring of migration progress, and initiation of agentless and agent-based migrations.
163
+
164
+[Learn more](/azure/migrate/prepare-azure-accounts)
165
+
166
+> [!div class="mx-tableFixed"]
167
+> | Actions | Description |
168
+> | --- | --- |
169
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
170
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
171
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
172
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/write | Creates or updates a resource group. |
173
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/locations/read | Gets the list of locations supported. |
174
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/checkResourceName/action | Check the resource name for validity. |
175
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/write | Creates or updates a deployment script |
176
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/read | Gets or lists deployment scripts |
177
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/write | Creates or updates a resource link. |
178
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
179
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/write | Add locks at the specified scope. |
180
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/delete | Delete locks at the specified scope. |
181
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
182
+> | [Microsoft.Migrate](../permissions/migration.md#microsoftmigrate)/*/read | |
183
+> | Microsoft.ApplicationMigration/*/read | |
184
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/*/read | |
185
+> | Microsoft.MySQLDiscovery/*/read | |
186
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
187
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/read | Gets a network interface definition. |
188
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/write | Creates a network interface or updates an existing network interface. |
189
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/delete | Deletes a network interface |
190
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |
191
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
192
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/*/read | |
193
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/*/write | |
194
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/listKeys/action | Returns the access keys for the specified storage account. |
195
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/register/action | Registers Subscription with Microsoft.Compute resource provider |
196
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/availabilitySets/read | Get the properties of an availability set |
197
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/availabilitySets/vmSizes/read | List available sizes for creating or updating a virtual machine in the availability set |
198
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/diskEncryptionSets/read | Get the properties of a disk encryption set |
199
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/skus/read | Gets the list of Microsoft.Compute SKUs available for your Subscription |
200
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/read | Get the properties of a Disk |
201
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/write | Creates a new Disk or updates an existing one |
202
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/delete | Deletes the Disk |
203
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/read | Get the properties of a virtual machine |
204
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/write | Creates a new virtual machine or updates an existing virtual machine |
205
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/delete | Deletes the virtual machine |
206
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/vaults/* | |
207
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/register/action | Registers subscription for given Resource Provider |
208
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/operations/read | Operation returns the list of Operations for a Resource Provider |
209
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/read | Gets or lists resource links. |
210
+> | Microsoft.DependencyMap/*/read | |
211
+> | Microsoft.DependencyMap/maps/*/action | |
212
+> | **NotActions** | |
213
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/hypervSites/machines/inventoryinsights/pendingupdates/* | |
214
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/hypervSites/machines/inventoryinsights/vulnerabilities/* | |
215
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/serverSites/machines/inventoryinsights/pendingupdates/* | |
216
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/serverSites/machines/inventoryinsights/vulnerabilities/* | |
217
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/vmwareSites/machines/inventoryinsights/vulnerabilities/* | |
218
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/vmwareSites/machines/inventoryinsights/pendingupdates/* | |
219
+> | **DataActions** | |
220
+> | *none* | |
221
+> | **NotDataActions** | |
222
+> | *none* | |
223
+> | **Actions** | |
224
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
225
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
226
+> | **NotActions** | |
227
+> | *none* | |
228
+> | **DataActions** | |
229
+> | *none* | |
230
+> | **NotDataActions** | |
231
+> | *none* | |
232
+> | **Condition** | |
233
+> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) | |
234
+
235
+```json
236
+{
237
+ "assignableScopes": [
238
+ "/"
239
+ ],
240
+ "description": "Grants restricted access on an Azure Migrate project to only perform migration related operations, including replication, execution of test migrations, tracking and monitoring of migration progress, and initiation of agentless and agent-based migrations.",
241
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/1cfa4eac-9a23-481c-a793-bfb6958e836b",
242
+ "name": "1cfa4eac-9a23-481c-a793-bfb6958e836b",
243
+ "permissions": [
244
+ {
245
+ "actions": [
246
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
247
+ "Microsoft.Resources/subscriptions/read",
248
+ "Microsoft.Resources/deployments/*",
249
+ "Microsoft.Resources/subscriptions/resourceGroups/write",
250
+ "Microsoft.Resources/subscriptions/locations/read",
251
+ "Microsoft.Resources/checkResourceName/action",
252
+ "Microsoft.Resources/deploymentScripts/write",
253
+ "Microsoft.Resources/deploymentScripts/read",
254
+ "Microsoft.Resources/links/write",
255
+ "Microsoft.Authorization/*/read",
256
+ "Microsoft.Authorization/locks/write",
257
+ "Microsoft.Authorization/locks/delete",
258
+ "Microsoft.Insights/alertRules/*",
259
+ "Microsoft.Migrate/*/read",
260
+ "Microsoft.ApplicationMigration/*/read",
261
+ "Microsoft.OffAzure/*/read",
262
+ "Microsoft.MySQLDiscovery/*/read",
263
+ "Microsoft.Support/*",
264
+ "Microsoft.Network/networkInterfaces/read",
265
+ "Microsoft.Network/networkInterfaces/write",
266
+ "Microsoft.Network/networkInterfaces/delete",
267
+ "Microsoft.Network/virtualNetworks/read",
268
+ "Microsoft.Network/virtualNetworks/subnets/read",
269
+ "Microsoft.Storage/storageAccounts/*/read",
270
+ "Microsoft.Storage/storageAccounts/*/write",
271
+ "Microsoft.Storage/storageAccounts/listKeys/action",
272
+ "Microsoft.Compute/register/action",
273
+ "Microsoft.Compute/availabilitySets/read",
274
+ "Microsoft.Compute/availabilitySets/vmSizes/read",
275
+ "Microsoft.Compute/diskEncryptionSets/read",
276
+ "Microsoft.Compute/skus/read",
277
+ "Microsoft.Compute/disks/read",
278
+ "Microsoft.Compute/disks/write",
279
+ "Microsoft.Compute/disks/delete",
280
+ "Microsoft.Compute/virtualMachines/read",
281
+ "Microsoft.Compute/virtualMachines/write",
282
+ "Microsoft.Compute/virtualMachines/delete",
283
+ "Microsoft.RecoveryServices/vaults/*",
284
+ "Microsoft.RecoveryServices/register/action",
285
+ "Microsoft.RecoveryServices/operations/read",
286
+ "Microsoft.Resources/links/read",
287
+ "Microsoft.DependencyMap/*/read",
288
+ "Microsoft.DependencyMap/maps/*/action"
289
+ ],
290
+ "notActions": [
291
+ "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*",
292
+ "Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*",
293
+ "Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*",
294
+ "Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*",
295
+ "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*",
296
+ "Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*"
297
+ ],
298
+ "dataActions": [],
299
+ "notDataActions": []
300
+ },
301
+ {
302
+ "actions": [
303
+ "Microsoft.Authorization/roleAssignments/write",
304
+ "Microsoft.Authorization/roleAssignments/delete"
305
+ ],
306
+ "notActions": [],
307
+ "dataActions": [],
308
+ "notDataActions": [],
309
+ "conditionVersion": "2.0",
310
+ "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe}))"
311
+ }
312
+ ],
313
+ "roleName": "Azure Migrate Execute Expert",
314
+ "roleType": "BuiltInRole",
315
+ "type": "Microsoft.Authorization/roleDefinitions"
316
+}
317
+```
318
+
319
+## Azure Migrate Owner
320
+
321
+Grants full access to create and manage Azure Migrate projects including appliance-based discovery, creation of business case & assessment report and execution of migrations; Also grants ability to assign Azure Migrate specific roles in Azure RBAC.
322
+
323
+[Learn more](/azure/migrate/prepare-azure-accounts)
324
+
325
+> [!div class="mx-tableFixed"]
326
+> | Actions | Description |
327
+> | --- | --- |
328
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |
329
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |
330
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/write | Creates or updates a resource group. |
331
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |
332
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/locations/read | Gets the list of locations supported. |
333
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/checkResourceName/action | Check the resource name for validity. |
334
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/write | Creates or updates a deployment script |
335
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deploymentScripts/read | Gets or lists deployment scripts |
336
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/write | Creates or updates a resource link. |
337
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |
338
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/write | Add locks at the specified scope. |
339
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/locks/delete | Delete locks at the specified scope. |
340
+> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |
341
+> | [Microsoft.Migrate](../permissions/migration.md#microsoftmigrate)/* | |
342
+> | Microsoft.ApplicationMigration/* | |
343
+> | [Microsoft.OffAzure](../permissions/migration.md#microsoftoffazure)/* | |
344
+> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |
345
+> | Microsoft.MySQLDiscovery/* | |
346
+> | Microsoft.DependencyMap/* | |
347
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/vaults/* | |
348
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/checkNameAvailability/read | Checks that a key vault name is valid and is not in use |
349
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/read | Read any Azure Arc machines |
350
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/write | Writes an Azure Arc machines |
351
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/delete | Deletes an Azure Arc machines |
352
+> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/register/action | Registers the subscription for the Microsoft.HybridCompute Resource Provider |
353
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/read | Gets a network interface definition. |
354
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/write | Creates a network interface or updates an existing network interface. |
355
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkInterfaces/delete | Deletes a network interface |
356
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/read | Get the virtual network definition |
357
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/write | Creates a virtual network subnet or updates an existing virtual network subnet |
358
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/join/action | Joins a virtual network. Not Alertable. |
359
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/networkSecurityGroups/join/action | Joins a network security group. Not Alertable. |
360
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/join/action | Joins a virtual network. Not Alertable. |
361
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/read | Gets an private endpoint resource. |
362
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/write | Creates a new private endpoint, or updates an existing private endpoint. |
363
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/privateDnsZoneGroups/write | Puts a Private DNS Zone Group |
364
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/write | Create or update a Private DNS zone within a resource group. Note that this command cannot be used to create or update virtual network links or record sets within the zone. |
365
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/virtualNetworkLinks/write | Create or update a Private DNS zone link to virtual network. |
366
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/join/action | Joins a Private DNS Zone |
367
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateDnsZones/A/write | Create or update a record set of type 'A' within a Private DNS zone. The records specified will replace the current records in the record set. |
368
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/register/action | Registers the subscription |
369
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/virtualNetworks/subnets/read | Gets a virtual network subnet definition |
370
+> | [Microsoft.Network](../permissions/networking.md#microsoftnetwork)/privateEndpoints/privateDnsZoneGroups/read | Gets a Private DNS Zone Group |
371
+> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/* | Create and manage storage accounts |
372
+> | [Microsoft.GuestConfiguration](../permissions/management-and-governance.md#microsoftguestconfiguration)/register/action | Registers the subscription for the Microsoft.GuestConfiguration resource provider. |
373
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/register/action | Registers Subscription with Microsoft.Compute resource provider |
374
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/availabilitySets/read | Get the properties of an availability set |
375
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/availabilitySets/vmSizes/read | List available sizes for creating or updating a virtual machine in the availability set |
376
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/diskEncryptionSets/read | Get the properties of a disk encryption set |
377
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/skus/read | Gets the list of Microsoft.Compute SKUs available for your Subscription |
378
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/read | Get the properties of a Disk |
379
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/write | Creates a new Disk or updates an existing one |
380
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/disks/delete | Deletes the Disk |
381
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/read | Get the properties of a virtual machine |
382
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/write | Creates a new virtual machine or updates an existing virtual machine |
383
+> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/delete | Deletes the virtual machine |
384
+> | [Microsoft.HybridConnectivity](../permissions/hybrid-multicloud.md#microsofthybridconnectivity)/register/action | Register the subscription for Microsoft.HybridConnectivity |
385
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/vaults/* | |
386
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/register/action | Registers subscription for given Resource Provider |
387
+> | [Microsoft.RecoveryServices](../permissions/management-and-governance.md#microsoftrecoveryservices)/operations/read | Operation returns the list of Operations for a Resource Provider |
388
+> | Microsoft.DataReplication/*/read | |
389
+> | Microsoft.DataReplication/register/action | Registers the subscription for the Microsoft.DataReplication resource provider |
390
+> | Microsoft.DataReplication/replicationVaults/write | Updates any vault |
391
+> | [Microsoft.KeyVault](../permissions/security.md#microsoftkeyvault)/register/action | Registers a subscription |
392
+> | Microsoft.AzureArcData/register/action | Register the subscription for Microsoft.AzureArcData |
393
+> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/links/read | Gets or lists resource links. |
394
+> | **NotActions** | |
395
+> | *none* | |
396
+> | **DataActions** | |
397
+> | *none* | |
398
+> | **NotDataActions** | |
399
+> | *none* | |
400
+> | **Actions** | |
401
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |
402
+> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |
403
+> | **NotActions** | |
404
+> | *none* | |
405
+> | **DataActions** | |
406
+> | *none* | |
407
+> | **NotDataActions** | |
408
+> | *none* | |
409
+> | **Condition** | |
410
+> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) | |
411
+
412
+```json
413
+{
414
+ "assignableScopes": [
415
+ "/"
416
+ ],
417
+ "description": "Grants full access to create and manage Azure Migrate projects including appliance-based discovery, creation of business case & assessment report and execution of migrations; Also grants ability to assign Azure Migrate specific roles in Azure RBAC.",
418
+ "id": "/providers/Microsoft.Authorization/roleDefinitions/fd8ea4d5-6509-4db0-bada-356ab233b4fa",
419
+ "name": "fd8ea4d5-6509-4db0-bada-356ab233b4fa",
420
+ "permissions": [
421
+ {
422
+ "actions": [
423
+ "Microsoft.Resources/subscriptions/resourceGroups/read",
424
+ "Microsoft.Resources/deployments/*",
425
+ "Microsoft.Resources/subscriptions/resourceGroups/write",
426
+ "Microsoft.Resources/subscriptions/read",
427
+ "Microsoft.Resources/subscriptions/locations/read",
428
+ "Microsoft.Resources/checkResourceName/action",
429
+ "Microsoft.Resources/deploymentScripts/write",
430
+ "Microsoft.Resources/deploymentScripts/read",
431
+ "Microsoft.Resources/links/write",
432
+ "Microsoft.Authorization/*/read",
433
+ "Microsoft.Authorization/locks/write",
434
+ "Microsoft.Authorization/locks/delete",
435
+ "Microsoft.Insights/alertRules/*",
436
+ "Microsoft.Migrate/*",
437
+ "Microsoft.ApplicationMigration/*",
438
+ "Microsoft.OffAzure/*",
439
+ "Microsoft.Support/*",
440
+ "Microsoft.MySQLDiscovery/*",
441
+ "Microsoft.DependencyMap/*",
442
+ "Microsoft.KeyVault/vaults/*",
443
+ "Microsoft.KeyVault/checkNameAvailability/read",
444
+ "Microsoft.HybridCompute/machines/read",
445
+ "Microsoft.HybridCompute/machines/write",
446
+ "Microsoft.HybridCompute/machines/delete",
447
+ "Microsoft.HybridCompute/register/action",
448
+ "Microsoft.Network/networkInterfaces/read",
449
+ "Microsoft.Network/networkInterfaces/write",
450
+ "Microsoft.Network/networkInterfaces/delete",
451
+ "Microsoft.Network/virtualNetworks/read",
452
+ "Microsoft.Network/virtualNetworks/subnets/write",
453
+ "Microsoft.Network/virtualNetworks/subnets/join/action",
454
+ "Microsoft.Network/networkSecurityGroups/join/action",
455
+ "Microsoft.Network/virtualNetworks/join/action",
456
+ "Microsoft.Network/privateEndpoints/read",
457
+ "Microsoft.Network/privateEndpoints/write",
458
+ "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write",
459
+ "Microsoft.Network/privateDnsZones/write",
460
+ "Microsoft.Network/privateDnsZones/virtualNetworkLinks/write",
461
+ "Microsoft.Network/privateDnsZones/join/action",
462
+ "Microsoft.Network/privateDnsZones/A/write",
463
+ "Microsoft.Network/register/action",
464
+ "Microsoft.Network/virtualNetworks/subnets/read",
465
+ "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read",
466
+ "Microsoft.Storage/storageAccounts/*",
467
+ "Microsoft.GuestConfiguration/register/action",
468
+ "Microsoft.Compute/register/action",
469
+ "Microsoft.Compute/availabilitySets/read",
470
+ "Microsoft.Compute/availabilitySets/vmSizes/read",
471
+ "Microsoft.Compute/diskEncryptionSets/read",
472
+ "Microsoft.Compute/skus/read",
473
+ "Microsoft.Compute/disks/read",
474
+ "Microsoft.Compute/disks/write",
475
+ "Microsoft.Compute/disks/delete",
476
+ "Microsoft.Compute/virtualMachines/read",
477
+ "Microsoft.Compute/virtualMachines/write",
478
+ "Microsoft.Compute/virtualMachines/delete",
479
+ "Microsoft.HybridConnectivity/register/action",
480
+ "Microsoft.RecoveryServices/vaults/*",
481
+ "Microsoft.RecoveryServices/register/action",
482
+ "Microsoft.RecoveryServices/operations/read",
483
+ "Microsoft.DataReplication/*/read",
484
+ "Microsoft.DataReplication/register/action",
485
+ "Microsoft.DataReplication/replicationVaults/write",
486
+ "Microsoft.KeyVault/register/action",
487
+ "Microsoft.AzureArcData/register/action",
488
+ "Microsoft.Resources/links/read"
489
+ ],
490
+ "notActions": [],
491
+ "dataActions": [],
492
+ "notDataActions": []
493
+ },
494
+ {
495
+ "actions": [
496
+ "Microsoft.Authorization/roleAssignments/write",
497
+ "Microsoft.Authorization/roleAssignments/delete"
498
+ ],
499
+ "notActions": [],
500
+ "dataActions": [],
501
+ "notDataActions": [],
502
+ "conditionVersion": "2.0",
503
+ "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{7859c0b0-0bb9-4994-bd12-cd529af7d646, 1cfa4eac-9a23-481c-a793-bfb6958e836b, 17d1049b-9a84-46fb-8f53-869881c3d3ab, ba92f5b4-2d11-453d-a403-e96b0029c9fe, ba480ccd-6499-4709-b581-8f38bb215c63}))"
504
+ }
505
+ ],
506
+ "roleName": "Azure Migrate Owner",
507
+ "roleType": "BuiltInRole",
508
+ "type": "Microsoft.Authorization/roleDefinitions"
509
+}
510
+```
511
+
512
+## Next steps
513
+
514
+- [Assign Azure roles using the Azure portal](/azure/role-based-access-control/role-assignments-portal)
Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.