Is there an Azure built-in role that can start/stop/restart virtual machines?

Paul Nerie 271

I seen how to do it by creating a custom role:
https://stackoverflow.com/questions/23668154/allow-users-to-start-stop-particular-azure-vms/49925159

Isn't there built-in role to do this?

Or can you directly assign a user such permissions on a VM without creating a role?

Thanks in advance!

vipullag-MSFT 26,306 Reputation points

2021-09-15T05:13:43.557+00:00

@Paul Nerie

Thanks for confirming that the issue is resolved.

Accepted answer

Paul Nerie 271 Reputation points

2021-09-15T05:05:31.443+00:00

Found it, it's 'Virtual Machine Contributor' role.
Please sign in to rate this answer.

5 people found this answer helpful.
Paul Jenkins 0 Reputation points

2023-09-22T18:59:10.75+00:00

Paul, thank you very much for taking the time to share this very clear walk-thru. I appreciate it!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

2 additional answers

Lopez, Jose Ramon 11

Virtual machine contributor gives more access than start/stopping/restarting a vm. better way is a custom rol as the link provided by Paul Nerie

Vladimir Petrov 0

True, here are all the actions that vm contributor gives, better use the custom role above.

                "actions": [
                    "Microsoft.Authorization/*/read",
                    "Microsoft.Compute/availabilitySets/*",
                    "Microsoft.Compute/locations/*",
                    "Microsoft.Compute/virtualMachines/*",
                    "Microsoft.Compute/virtualMachineScaleSets/*",
                    "Microsoft.Compute/cloudServices/*",
                    "Microsoft.Compute/disks/write",
                    "Microsoft.Compute/disks/read",
                    "Microsoft.Compute/disks/delete",
                    "Microsoft.DevTestLab/schedules/*",
                    "Microsoft.Insights/alertRules/*",
                    "Microsoft.Network/applicationGateways/backendAddressPools/join/action",
                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
                    "Microsoft.Network/loadBalancers/inboundNatPools/join/action",
                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
                    "Microsoft.Network/loadBalancers/probes/join/action",
                    "Microsoft.Network/loadBalancers/read",
                    "Microsoft.Network/locations/*",
                    "Microsoft.Network/networkInterfaces/*",
                    "Microsoft.Network/networkSecurityGroups/join/action",
                    "Microsoft.Network/networkSecurityGroups/read",
                    "Microsoft.Network/publicIPAddresses/join/action",
                    "Microsoft.Network/publicIPAddresses/read",
                    "Microsoft.Network/virtualNetworks/read",
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                    "Microsoft.RecoveryServices/locations/*",
                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/*/read",
                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
                    "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
                    "Microsoft.RecoveryServices/Vaults/backupPolicies/write",
                    "Microsoft.RecoveryServices/Vaults/read",
                    "Microsoft.RecoveryServices/Vaults/usages/read",
                    "Microsoft.RecoveryServices/Vaults/write",
                    "Microsoft.ResourceHealth/availabilityStatuses/read",
                    "Microsoft.Resources/deployments/*",
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                    "Microsoft.SerialConsole/serialPorts/connect/action",
                    "Microsoft.SqlVirtualMachine/*",
                    "Microsoft.Storage/storageAccounts/listKeys/action",
                    "Microsoft.Storage/storageAccounts/read",
                    "Microsoft.Support/*"

Birendra Singh 181 Reputation points

2021-09-15T06:22:39.34+00:00

Hi There,

Adding Azure AD users in RBAC of VM and assigning them Virtual Machine Contributor role can help on that
Please sign in to rate this answer.
Paul Nerie 271 Reputation points

2021-09-15T08:09:47.593+00:00

Thank you BIRENDRA. I figured it out earlier.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Is there an Azure built-in role that can start/stop/restart virtual machines?

2 additional answers

Your answer