Ive created a custom role to allow this. I've tested and it works.
You have to start with the "Virtual Machine User Login" role then add the additional permissions. This does of course give the user log permissions as well but I assume if you are allowing them to start and stop the VM then you would also want them the ability to log in.
Via the GUI:
1. Add Custom Role
2. Select "Clone a role" and role to close is "Virtual Machine User Login"
3. Click Next
4. Select add permissions
5. Scroll down to "Microsoft.Compute.VirtualMachines" and tick
Microsoft.Compute/virtualMachines/start/action"
"Microsoft.Compute/virtualMachines/powerOff/action"
"Microsoft.Compute/virtualMachines/deallocate/action"
6. Click Next, select subscription, Next, Next then "Create".
7. List item
All permissions for the role:
- Action Microsoft.Network/publicIPAddresses/read
- Action Microsoft.Network/virtualNetworks/read
- Action Microsoft.Network/virtualNetworks/read
- Action Microsoft.Network/loadBalancers/read
- Action Microsoft.Network/networkInterfaces/read
- Action Microsoft.Compute/virtualMachines/*/read
- Action Microsoft.Compute/virtualMachines/start/action
- Action Microsoft.Compute/virtualMachines/powerOff/action
- Action Microsoft.Compute/virtualMachines/deallocate/action
- DataAction Microsoft.Compute/virtualMachines/login/action
Here's the JSON:
{ "properties": { "roleName": "VM_Operator_test", "description": "", "assignableScopes": [ "/subscriptions/exampesubscription/EXAMPLE_RG" ], "permissions": [ { "actions": [ "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/loadBalancers/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Compute/virtualMachines/*/read", "Microsoft.Compute/virtualMachines/start/action", "Microsoft.Compute/virtualMachines/powerOff/action", "Microsoft.Compute/virtualMachines/deallocate/action" ], "notActions": [], "dataActions": [ "Microsoft.Compute/virtualMachines/login/action" ], "notDataActions": [] } ] }}