22

Our sales team will be using Azure VMs to do sales demos. I would like to be able to allow certain people to be able to start/stop their own VMs at will. I've seen being able to add people as an administrator in the management portal, but this seems to give them access to our whole subscription. I'd like to be able to manage this without having everyone create their own subscription.

Example scenario:

Person A is able to start/stop Person A's dedicated VM.

Person B is able to start/stop Person B's dedicated VM. etc.

7 Answers 7

27

In order to allow a user to start and stop a virtual machine you need to create a custom role with the right permissions.

In this answer I will list the steps to follow in order to get this result using the azure command line interface. You can do the same using the Power Shell or the Azure Rest Api (find more information about the commands to be used with the Power Shell at this link and with the Azure Rest Api at this link).

  • Create a JSON file with the following content (let us name it newRole.json):

    {
      "Name": "Virtual Machine Operator",
      "IsCustom": true,
      "Description": "Can deallocate, start  and restart virtual machines.",
      "Actions": [
        "Microsoft.Compute/*/read",
        "Microsoft.Compute/virtualMachines/start/action",
        "Microsoft.Compute/virtualMachines/restart/action",
        "Microsoft.Compute/virtualMachines/deallocate/action"
      ],
      "NotActions": [

], "AssignableScopes": [ "/subscriptions/11111111-1111-1111-1111-111111111111" ] }

  • A short explanation of each field of the JSON file:

    • Name: the name of the new role. This is the name that will be shown in the azure portal
    • Is Custom: specifies that it is a user defined role
    • Description: a short description of the role, is is shown as well in the azure portal
    • Actions: the list of action that can be performed by a user associated to this role. Respectively each line allows the user to:
      • See the list of virtual machines (not all of them, we will see later how to specify which VM will be visible to each user)
      • Start one of the virtual machine among those in the list
      • Restart one of the virtual machine among those in the list
      • Deallocate one of the virtual machine among those in the list
    • No Actions: the list of action that can't be performed by a user associated to this role. In this case the list is empty, in general it has to be a subset of the previous field.
    • AssignableScopes: the set of your subscriptions where the role has to be added. Each code is prefixed by the /subscription/ string. You can find the code of your subscription by accessing the subscription menu (identified by this icon)

      enter image description here

      and copy the value under SUBSCRIPTION ID column

  • Login to your azure account with the azure cli executing the command az login. More information about how to install the azure cli and perform the login process respectively here and here.
  • Create the new role executing the command az role definition create --role-definition newRole.json.
  • Access the portal and select the virtual machine that has to be powered on and off by a user of your choice
  • After you selected the machine select Access control (Iam)

    enter image description here

  • From the new blade select Add

  • Fill in the fields as follow:
    • Role: Select the role you just created, in our case Virtual Machine Operator
    • Assign access to: Azure AD user, group, or application.
    • Select: the email associated to the account that needs to start/restart/stop the VM
  • Press save

After this operations when the user will access the portal she will see the selected VM in the list of the virtual machines. If she selects the virtual machine she will be able to start/restart/stop it.

2
  • 4
    This works well, but for a VM-operator they might benefit from additional permissions (e.g. this role won't let the Operator see the machines public IP). Microsoft has a tutorial here with Virtual Machine Operator as the specific example: learn.microsoft.com/en-us/azure/role-based-access-control/…
    – AdamAL
    May 9, 2019 at 8:14
  • Microsoft.Compute/*/read gives the user read access to a lot more than just the basic VM properties (which is required to see the Stop/Start buttons). They get read access to disks, images, galleries, host groups, restore points, etc. A better permission would be Microsoft.Compute/virtualMachines/read.
    – Mortein
    yesterday
11

Open your VM in portal.azure.com navigate to Access control (IAM)Role Assignments and click Add Role Assignment.

Select standard role Virtual Machine Contributor,

Assign access to leave by default (Azure AD user, group ...),

In Select field enter email of new limited user and select Guest.

Save.

That's all. enter image description here

1
  • 1
    Consider that this solution gives much more access to the employee other than allowing to start/stop the VM. The Virtual Machine Contributor role also allows to modify the availability sets, disks, vm and network configuration, vaults, protection policies, etc. While this role does technically answer the question about start/stop VM, I understand from the OP that the employees are not no change the VMs, they just need to be able to start/stop them so they can use them.
    – PedroC88
    Oct 11, 2021 at 15:13
5

Ive created a custom role to allow this. I've tested and it works. You have to start with the "Virtual Machine User Login" role then add the additional permissions. This does of course give the user log permissions as well but I assume if you are allowing them to start and stop the VM then you would also want them the ability to log in.

Via the GUI:

 1. Add Custom Role
 2. Select "Clone a role" and role to close is "Virtual Machine User Login"
 3. Click Next
 4. Select add permissions
 5. Scroll  down to "Microsoft.Compute.VirtualMachines" and tick
Microsoft.Compute/virtualMachines/start/action"
"Microsoft.Compute/virtualMachines/powerOff/action"
"Microsoft.Compute/virtualMachines/deallocate/action"
 6. Click Next, select subscription, Next, Next then "Create".
 7. List item

All permissions for the role:

  • Action Microsoft.Network/publicIPAddresses/read
  • Action Microsoft.Network/virtualNetworks/read
  • Action Microsoft.Network/virtualNetworks/read
  • Action Microsoft.Network/loadBalancers/read
  • Action Microsoft.Network/networkInterfaces/read
  • Action Microsoft.Compute/virtualMachines/*/read
  • Action Microsoft.Compute/virtualMachines/start/action
  • Action Microsoft.Compute/virtualMachines/powerOff/action
  • Action Microsoft.Compute/virtualMachines/deallocate/action
  • DataAction Microsoft.Compute/virtualMachines/login/action

Here's the JSON:

{ "properties": { "roleName": "VM_Operator_test", "description": "", "assignableScopes": [ "/subscriptions/exampesubscription/EXAMPLE_RG" ], "permissions": [ { "actions": [ "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/loadBalancers/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Compute/virtualMachines/*/read", "Microsoft.Compute/virtualMachines/start/action", "Microsoft.Compute/virtualMachines/powerOff/action", "Microsoft.Compute/virtualMachines/deallocate/action" ], "notActions": [], "dataActions": [ "Microsoft.Compute/virtualMachines/login/action" ], "notDataActions": [] } ] }}

1

Through azure-cli

  • create custom-role file "VirtualMachineStartStop.json"

              {
                "Name": "Virtual Machine Start Stop Access",
                "IsCustom": true,
                "Description": "Start/Restart/Deallocate virtual machines",
                "Actions": [
                  "Microsoft.Storage/*/read",
                  "Microsoft.Network/*/read",
                  "Microsoft.Compute/*/read",
                  "Microsoft.Compute/virtualMachines/start/action",
                  "Microsoft.Compute/virtualMachines/restart/action",
                  "Microsoft.Compute/virtualMachines/deallocate/action"
                ],
                "NotActions": [
    
    
                ],
                "AssignableScopes": [
                  "/subscriptions/<azure_subscription_id_here>"
                ] 
      }
    
  • Create role

    az role definition create --role-definition "./VirtualMachineStartStop.json"

  • Confirm the role creation

    az role definition list --custom-role-only true

0

Currently this is not possible. Though it is possible via some programming. What you see on Azure Portal can be achieved through Azure Service Management API. What you could do is write an application which consumes this API and there you could define all the rules.

If you think your sales folks will not mess around, another thing you could do is create some custom PowerShell scripts by making use of Azure PowerShell Cmdlets and they can just execute those scripts to start/stop the VMs.

1
  • I agree with the Azure Powershell Cmdlets. Had been testing them out yesterday. However, how would I go about getting their users authenticated in Windows Azure Powershell? Do I still need to add them as administrators in the management portal? May 15, 2014 at 16:31
0

My recommendation would be to build your own façade that leverages the Azure Management API to perform these tasks for you. This allows you to put in place your own controls around access/authorization as well as rig it to span multiple subscriptions (should this ever prove necessary). This façade could potentially be hosted in a free tier Azure web site.

0

In case you cannot create custom roles, you now have the "Desktop Virtualization Power On Off Contributor" role; which can both start and stop the Virtual Machine (VM). There is also the " Desktop Virtualization Power On Contributor" role which can only start the VM.

You can assign this in the CLI with the command below with the necessary placeholders filled in;

az role assignment create \
  --assignee *userObjectId* \
  --role "Desktop Virtualization Power On Off Contributor" \
  --scope "/subscriptions/*Your Subscription ID*/resourceGroups/*YourResourceGroup*/providers/Microsoft.Compute/virtualMachines/*YourVirtualMachineName*"

You will need to substitute SubscriptionId, ResourceGroupName, VirtualMachineName and also userObjectId which you can get from the query below.

az ad user show --id "[email protected]" --query objectId --output tsv

Not the answer you're looking for? Browse other questions tagged or ask your own question.