RBAC Reference

This page provides least-privilege role mapping for AVD control-plane deployment and operations.

1) Role matrix

Persona	Scope	Recommended role(s)
Platform engineer	Subscription/RG	Contributor (deployment scope only)
Security operations	Subscription/RG	Reader, Security Reader
Monitoring operations	Log Analytics	Log Analytics Reader
Helpdesk (user session support)	Host pool / app group	Desktop Virtualization Reader + operational custom role as needed
End users	Application Group	Desktop Virtualization User

2) Least-privilege principles

• Assign at the narrowest possible scope.
• Use Entra groups instead of direct user role assignments.
• Separate deployment roles from operations roles.
• Use temporary elevation (PIM) for high-privilege actions.

3) Example custom role (deployment manager)

{
	"Name": "AVD.DeploymentManager",
	"Description": "Deploy and update AVD control-plane resources without full subscription owner rights.",
	"Actions": [
		"Microsoft.DesktopVirtualization/*",
		"Microsoft.Insights/diagnosticSettings/*",
		"Microsoft.OperationalInsights/workspaces/read",
		"Microsoft.Authorization/roleAssignments/read",
		"Microsoft.Resources/subscriptions/resourceGroups/read"
	],
	"NotActions": [
		"Microsoft.Authorization/roleAssignments/delete"
	],
	"AssignableScopes": [
		"/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>"
	]
}

4) CLI assignment examples

az role assignment create \
	--assignee-object-id <entra-group-object-id> \
	--assignee-principal-type Group \
	--role "Desktop Virtualization User" \
	--scope /subscriptions/<subId>/resourceGroups/<rg>/providers/Microsoft.DesktopVirtualization/applicationGroups/<appGroup>

az role assignment create \
	--assignee-object-id <ops-group-object-id> \
	--assignee-principal-type Group \
	--role "Log Analytics Reader" \
	--scope /subscriptions/<subId>/resourceGroups/<rg>/providers/Microsoft.OperationalInsights/workspaces/<law>

5) PowerShell assignment example

New-AzRoleAssignment -ObjectId $GroupObjectId -RoleDefinitionName "Desktop Virtualization User" -Scope $AppGroupScope

6) Governance checks

• Weekly: detect direct user assignments at subscription scope.
• Monthly: review stale privileged role assignments.
• Quarterly: role recertification with service owners.