AzRoleAdvertizer

last sync: 2025-Oct-30 18:22:48 UTC

Azure Migrate Execute Expert

Azure BuiltIn RBAC Role definition

NameAzure Migrate Execute Expert
Id1cfa4eac-9a23-481c-a793-bfb6958e836b
DescriptionGrants restricted access on an Azure Migrate project to only perform migration related operations, including replication, execution of test migrations, tracking and monitoring of migration progress, and initiation of agentless and agent-based migrations.
CategoryNone
CreatedOn2025-09-09 08:45:37 UTC
UpdatedOn2025-10-23 09:42:33 UTC
Permissions summary Effective control plane and data plane operations: 666 (unique operations)
•: 1
•action: 97
•delete: 28
•read: 463
•write: 77

Actions: 45
Resolved control plane operations from Actions: 672
Effective control plane operations: 666
•: 1
•action: 97
•delete: 28
•read: 463
•write: 77

NotActions: 6
Resolved control plane operations from NotActions: 6
Effective denied control plane operations: 16799

DataActions: 0
Resolved data plane operations: 0
Effective data plane operations: 0

NotDataActions: 0
Resolved data plane operations from NotDataActions: 0
Effective denied data plane operations: 4081
Actions
Operation Description
Microsoft.ApplicationMigration/*/readwildcarded / no description
Microsoft.Authorization/*/readwildcarded / no description
Microsoft.Authorization/locks/deleteDelete locks at the specified scope.
Microsoft.Authorization/locks/writeAdd locks at the specified scope.
Microsoft.Authorization/roleAssignments/delete conditionedDelete a role assignment at the specified scope.
Microsoft.Authorization/roleAssignments/write conditionedCreate a role assignment at the specified scope.
Microsoft.Compute/availabilitySets/readGet the properties of an availability set
Microsoft.Compute/availabilitySets/vmSizes/readList available sizes for creating or updating a virtual machine in the availability set
Microsoft.Compute/diskEncryptionSets/readGet the properties of a disk encryption set
Microsoft.Compute/disks/deleteDeletes the Disk
Microsoft.Compute/disks/readGet the properties of a Disk
Microsoft.Compute/disks/writeCreates a new Disk or updates an existing one
Microsoft.Compute/register/actionRegisters Subscription with Microsoft.Compute resource provider
Microsoft.Compute/skus/readGets the list of Microsoft.Compute SKUs available for your Subscription
Microsoft.Compute/virtualMachines/deleteDeletes the virtual machine
Microsoft.Compute/virtualMachines/readGet the properties of a virtual machine
Microsoft.Compute/virtualMachines/writeCreates a new virtual machine or updates an existing virtual machine
Microsoft.DependencyMap/*/readwildcarded / no description
Microsoft.DependencyMap/maps/*/actionwildcarded / no description
Microsoft.Insights/alertRules/*wildcarded / no description
Microsoft.Migrate/*/readwildcarded / no description
Microsoft.MySQLDiscovery/*/readwildcarded / no description
Microsoft.Network/networkInterfaces/deleteDeletes a network interface
Microsoft.Network/networkInterfaces/readGets a network interface definition.
Microsoft.Network/networkInterfaces/writeCreates a network interface or updates an existing network interface.
Microsoft.Network/virtualNetworks/readGet the virtual network definition
Microsoft.Network/virtualNetworks/subnets/readGets a virtual network subnet definition
Microsoft.OffAzure/*/readwildcarded / no description
Microsoft.RecoveryServices/operations/readOperation returns the list of Operations for a Resource Provider
Microsoft.RecoveryServices/register/actionRegisters subscription for given Resource Provider
Microsoft.RecoveryServices/vaults/*wildcarded / no description
Microsoft.Resources/checkResourceName/actionCheck the resource name for validity.
Microsoft.Resources/deployments/*wildcarded / no description
Microsoft.Resources/deploymentScripts/readGets or lists deployment scripts
Microsoft.Resources/deploymentScripts/writeCreates or updates a deployment script
Microsoft.Resources/links/readGets or lists resource links.
Microsoft.Resources/links/writeCreates or updates a resource link.
Microsoft.Resources/subscriptions/locations/readGets the list of locations supported.
Microsoft.Resources/subscriptions/readGets the list of subscriptions.
Microsoft.Resources/subscriptions/resourceGroups/readGets or lists resource groups.
Microsoft.Resources/subscriptions/resourceGroups/writeCreates or updates a resource group.
Microsoft.Storage/storageAccounts/*/readwildcarded / no description
Microsoft.Storage/storageAccounts/*/writewildcarded / no description
Microsoft.Storage/storageAccounts/listKeys/actionReturns the access keys for the specified storage account.
Microsoft.Support/*wildcarded / no description
NotActions
Operation Description
Microsoft.OffAzure/hypervSites/machines/inventoryinsights/pendingupdates/*wildcarded / no description
Microsoft.OffAzure/hypervSites/machines/inventoryinsights/vulnerabilities/*wildcarded / no description
Microsoft.OffAzure/serverSites/machines/inventoryinsights/pendingupdates/*wildcarded / no description
Microsoft.OffAzure/serverSites/machines/inventoryinsights/vulnerabilities/*wildcarded / no description
Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/pendingupdates/*wildcarded / no description
Microsoft.OffAzure/vmwareSites/machines/inventoryinsights/vulnerabilities/*wildcarded / no description
DataActions n/a
NotDataActions n/a
Used in
BuiltIn Policy		 none
History
Date/Time (UTC ymd) (i) Change Change detail
2025-10-23 17:22:49 add: Role 1cfa4eac-9a23-481c-a793-bfb6958e836b
JSON
api-version=2023-07-01-preview
Condition
    
    (
        (
            !
            (
                ActionMatches {
                'Microsoft.Authorization/roleAssignments/write'
                }
            )
        )
        OR
        (
            @Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {
            17d1049b-9a84-46fb-8f53-869881c3d3ab (Storage Account Contributor),
            ba92f5b4-2d11-453d-a403-e96b0029c9fe (Storage Blob Data Contributor)
            }
        )
    )
    AND
    (
        (
            !
            (
                ActionMatches {
                'Microsoft.Authorization/roleAssignments/delete'
                }
            )
        )
        OR
        (
            @Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals {
            17d1049b-9a84-46fb-8f53-869881c3d3ab (Storage Account Contributor),
            ba92f5b4-2d11-453d-a403-e96b0029c9fe (Storage Blob Data Contributor)
            }
        )
    )