Is there an Azure built-in role that can start/stop/restart virtual machines?

Question

Is there an Azure built-in role that can start/stop/restart virtual machines?

Paul Nerie 281

I seen how to do it by creating a custom role:
https://stackoverflow.com/questions/23668154/allow-users-to-start-stop-particular-azure-vms/49925159

Isn't there built-in role to do this?

Or can you directly assign a user such permissions on a VM without creating a role?

Thanks in advance!

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

vipullag-MSFT 26,537 Reputation points Moderator

2021-09-15T05:13:43.557+00:00

@Paul Nerie

Thanks for confirming that the issue is resolved.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer accepted by question author

Paul Nerie 281

Found it, it's 'Virtual Machine Contributor' role.

Anonymous

2023-09-22T18:59:10.75+00:00

Paul, thank you very much for taking the time to share this very clear walk-thru. I appreciate it!
Schroeder, Michael (CTR) 41 Reputation points

2026-10-07T15:18:46.4133333+00:00

This is a bad answer! For anybody who finds this thread in the future, the suggested Virtual Machine Contributor role can do a lot more than start and stop Virtual Machines. It shold not be used when that is the need. Create a proper least privilege custom role.

2 additional answers

vipullag-MSFT 26,537 Reputation points Moderator

2021-09-15T05:13:43.557+00:00

@Paul Nerie

Thanks for confirming that the issue is resolved.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Anonymous

2023-09-22T18:59:10.75+00:00

Paul, thank you very much for taking the time to share this very clear walk-thru. I appreciate it!
Schroeder, Michael (CTR) 41 Reputation points

2026-10-07T15:18:46.4133333+00:00

This is a bad answer! For anybody who finds this thread in the future, the suggested Virtual Machine Contributor role can do a lot more than start and stop Virtual Machines. It shold not be used when that is the need. Create a proper least privilege custom role.

Answer 1

Birendra Singh 181

Hi There,

Adding Azure AD users in RBAC of VM and assigning them Virtual Machine Contributor role can help on that

Paul Nerie 281 Reputation points

2021-09-15T08:09:47.593+00:00

Thank you BIRENDRA. I figured it out earlier.

Answer 2

Jose Lopez 11

Virtual machine contributor gives more access than start/stopping/restarting a vm. better way is a custom rol as the link provided by Paul Nerie

Vladimir Petrov 0

True, here are all the actions that vm contributor gives, better use the custom role above.

                "actions": [
                    "Microsoft.Authorization/*/read",
                    "Microsoft.Compute/availabilitySets/*",
                    "Microsoft.Compute/locations/*",
                    "Microsoft.Compute/virtualMachines/*",
                    "Microsoft.Compute/virtualMachineScaleSets/*",
                    "Microsoft.Compute/cloudServices/*",
                    "Microsoft.Compute/disks/write",
                    "Microsoft.Compute/disks/read",
                    "Microsoft.Compute/disks/delete",
                    "Microsoft.DevTestLab/schedules/*",
                    "Microsoft.Insights/alertRules/*",
                    "Microsoft.Network/applicationGateways/backendAddressPools/join/action",
                    "Microsoft.Network/loadBalancers/backendAddressPools/join/action",
                    "Microsoft.Network/loadBalancers/inboundNatPools/join/action",
                    "Microsoft.Network/loadBalancers/inboundNatRules/join/action",
                    "Microsoft.Network/loadBalancers/probes/join/action",
                    "Microsoft.Network/loadBalancers/read",
                    "Microsoft.Network/locations/*",
                    "Microsoft.Network/networkInterfaces/*",
                    "Microsoft.Network/networkSecurityGroups/join/action",
                    "Microsoft.Network/networkSecurityGroups/read",
                    "Microsoft.Network/publicIPAddresses/join/action",
                    "Microsoft.Network/publicIPAddresses/read",
                    "Microsoft.Network/virtualNetworks/read",
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                    "Microsoft.RecoveryServices/locations/*",
                    "Microsoft.RecoveryServices/Vaults/backupFabrics/backupProtectionIntent/write",
                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/*/read",
                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/read",
                    "Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/write",
                    "Microsoft.RecoveryServices/Vaults/backupPolicies/read",
                    "Microsoft.RecoveryServices/Vaults/backupPolicies/write",
                    "Microsoft.RecoveryServices/Vaults/read",
                    "Microsoft.RecoveryServices/Vaults/usages/read",
                    "Microsoft.RecoveryServices/Vaults/write",
                    "Microsoft.ResourceHealth/availabilityStatuses/read",
                    "Microsoft.Resources/deployments/*",
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                    "Microsoft.SerialConsole/serialPorts/connect/action",
                    "Microsoft.SqlVirtualMachine/*",
                    "Microsoft.Storage/storageAccounts/listKeys/action",
                    "Microsoft.Storage/storageAccounts/read",
                    "Microsoft.Support/*"