User cannot create a VM with just the Virtual Machine Contributor role

Question

Apologies if this has already been answered, but based on my testing, they also need a Storage Account Contributor Role, Network Contributor Role and the permission Microsoft.Compute/sshPublicKeys/write which does not seem to be in built in role, at least that I can find. Is there a way to do this without making a custom role?

Answer 1

@Noopur Pathak

The full description of the Virtual Machine Contributor role and individual permissions can be found here. Create and manage virtual machines, manage disks, install and run software, reset password of the root user of the virtual machine using VM extensions, and manage local user accounts using VM extensions. This role does not grant you management access to the virtual network or storage account the virtual machines are connected to. This role does not allow you to assign roles in Azure RBAC.

The role has necessary permissions, but the VNET, Network Security Group, public IP, and storage account (if using boot diagnostics) needs to be created first, by a user with permissions. If those items are already created, then the role will provide the necessary permissions to create a VM. You could add the Network Contributor role, if you want to create the network items when creating the VM.

Hope this helps. Let me know if you have further questions or issues.

---

If you still have questions, please let us know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts.

If the answer has been helpful, we appreciate hearing from you and would love to help others who may have the same question. Accepting answers helps increase visibility of this question for other members of the Microsoft Q&A community.

Thank you for helping to improve Microsoft Q&A!

Answer 2

Based on comments by @deherman-MSFT , it looks like the answer is a custom role that includes the Network Contributor Role, Storage Account Contributor Role and Microsoft.Compute/sshPublicKeys/write permissions.