Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure role-based access control (Azure RBAC) enables fine-grained access management for Azure. Using Azure RBAC, you can segregate responsibilities within your team and grant only specific access permissions to users as needed to perform specific jobs.
Azure Site Recovery provides 3 built-in roles to control Site Recovery management operations. Learn more on Azure built-in roles
- Site Recovery Contributor - This role has all permissions required to manage Azure Site Recovery operations in a Recovery Services vault. A user with this role, however, can't create or delete a Recovery Services vault or assign access rights to other users. This role is best suited for disaster recovery administrators who can enable and manage disaster recovery for applications or entire organizations, as the case may be.
- Site Recovery Operator - This role has permissions to execute and manage Failover and Failback operations. A user with this role can't enable or disable replication, create or delete vaults, register new infrastructure or assign access rights to other users. This role is best suited for a disaster recovery operator who can failover virtual machines or applications when instructed by application owners and IT administrators in an actual or simulated disaster situation such as a DR drill. Post resolution of the disaster, the DR operator can re-protect and failback the virtual machines.
- Site Recovery Reader - This role has permissions to view all Site Recovery management operations. This role is best suited for an IT monitoring executive who can monitor the current state of protection and raise support tickets if required.
If you're looking to define your own roles for even more control, see how to build custom roles in Azure.
Permissions required to perform replication and failover actions on virtual machines
When you replicate a virtual machine by using Azure Site Recovery or perform other actions such as failover, Azure Site Recovery validates your access levels. This validation ensures you have the required permissions to use the Azure resources provided to Site Recovery.
Important
Add the relevant permissions for the user for each Site Recovery action they're allowed to perform.
Note
If you are enabling replication for an Azure VM and want to allow Site Recovery to manage updates, then while enabling replication you may also want to create a new Automation account in which case you would need permission to create an automation account in the same subscription as the vault as well.
| Operation Type | Permissions required | Scope required | Recommended built-in roles |
|---|---|---|---|
| Enable Replication, Update Replication, Reprotect | Microsoft.Compute/virtualMachines/read | Source VM, Target Resource Group | Site Recovery Contributor, Virtual Machine Contributor, Network Contributor, Storage Account Contributor, Key Vault Contributor, Reader |
| Microsoft.Compute/virtualMachines/write | Source VM | ||
| Microsoft.Compute/disks/read | Source VM, Target Resource Group | ||
| Microsoft.Compute/disks/write | Source VM | ||
| Microsoft.Compute/disks/delete | Source VM | ||
| Microsoft.Compute/diskAccesses/read | Target Disk Access | ||
| Microsoft.Compute/diskEncryptionSets/read | Target Disk Encryption Set | ||
| Microsoft.Compute/availabilitySets/read | Target Availability Set | ||
| Microsoft.Compute/availabilitySets/write | Target Availability Set | ||
| Microsoft.Compute/virtualMachineScaleSets/read | Target Virtual Machine Scale Set (VMSS) | ||
| Microsoft.Compute/proximityPlacementGroups/read | Target Proximity Placement Group (PPG) | ||
| Microsoft.Compute/proximityPlacementGroups/write | Target Proximity Placement Group (PPG) | ||
| Microsoft.Compute/capacityReservationGroups/read | Target Capacity reservation group | ||
| Microsoft.Network/virtualNetworks/read | Target Virtual Network | ||
| Microsoft.Network/virtualNetworks/write | Target Virtual Network | ||
| Microsoft.Network/networkSecurityGroups/read | Target Network Security Group | ||
| Microsoft.Network/networkInterfaces/read | Target Resource Group | ||
| Microsoft.Network/loadBalancers/read | Target Load Balancer | ||
| Microsoft.Network/publicIPAddresses/read | Target Public IP Address | ||
| Microsoft.Storage/storageAccounts/read | Cache Storage Account, Target Boot Diagnostics Storage Account | ||
| Microsoft.Storage/storageAccounts/write | Cache Storage Account | ||
| Microsoft.KeyVault/vaults/deploy/action | Target Key Vault | ||
| Microsoft.Automation/automationAccounts/read | Azure Automation Account (only if using ASR managed Site Recovery extension updates) | ||
| Add disks for replication | Microsoft.Compute/virtualMachines/read | Source VM, Target Resource Group | Site Recovery Contributor, Reader |
| Microsoft.Compute/disks/read | Source VM, Target Resource Group | ||
| Microsoft.Compute/diskAccesses/read | Target Disk Access | ||
| Microsoft.Compute/diskEncryptionSets/read | Target Disk Encryption Set | ||
| Microsoft.Storage/storageAccounts/read | Cache Storage Account | ||
| Failover, Test Failover | Microsoft.Network/virtualNetworks/read | Target Virtual Network | Site Recovery Operator, Reader |
| Microsoft.Compute/capacityReservationGroups/read | Target Capacity reservation group | ||
| Create and Update Recovery Plans | Microsoft.Automation/automationAccounts/read | Automation accounts selected in plan configuration | Site Recovery Contributor, Reader |
Consider using the preceding recommended roles or other relevant least privilege built-in roles or create a custom role with the required permissions.
Next steps
- Azure role-based access control (Azure RBAC): Get started with Azure RBAC in the Azure portal.
- Learn how to manage access with:
- Azure RBAC troubleshooting: Get suggestions for fixing common issues.