---

title: Register your Azure Local machines with Azure Arc and assign permissions for deployment description: Learn how to register your Azure Local machines with Azure Arc and assign permissions for deployment. author: ronmiab ms.topic: how-to ms.date: 07/30/2025 ms.author: robess ms.service: azure-local ms.custom:

• devx-track-azurepowershell
• sfi-image-nochange ms.subservice: hyperconverged

---

Assign required permissions for Azure Local deployment

[!INCLUDE applies-to]

This article describes how to set up the required permissions on your subscription to deploy Azure Local.

Prerequisites

Azure Local machine prerequisites

[!INCLUDE hci-registration-azure-local-machine-prerequisites]

Azure prerequisites

[!INCLUDE hci-registration-azure-prerequisites]

Assign Azure permissions for deployment

Follow these steps to assign Azure permissions for deployment from the Azure portal.

1. In the Azure portal, go to the resource group used to register the machines on your subscription. In the left pane, select Access control (IAM). In the right pane, select + Add and from the dropdown list, select Add role assignment.

   :::image type="content" source="media/deployment-arc-register-server-permissions/add-role-assignment.png" alt-text="Screenshot of the Add role assignment in Access control in resource group for Azure Local deployment." lightbox="./media/deployment-arc-register-server-permissions/add-role-assignment.png":::

2. Go through the tabs and assign the following role permissions to the user who deploys the instance:

   • Azure Stack HCI Administrator
   • Reader

3. In the Azure portal, go to the resource group used to register the machines on your subscription. In the left pane, select Access control (IAM). In the right pane, select + Add and from the dropdown list, select Add role assignment.

   :::image type="content" source="media/deployment-arc-register-server-permissions/add-role-assignment.png" alt-text="Screenshot of the Add role assignment in Access control in resource group for Azure Local deployment." lightbox="./media/deployment-arc-register-server-permissions/add-role-assignment.png":::

4. Go through the tabs and assign the following permissions to the user who deploys the instance:

   • Key Vault Data Access Administrator: This permission is required to manage data plane permissions to the key vault used for deployment.
   • Key Vault Secrets Officer: This permission is required to read and write secrets in the key vault used for deployment.
   • Key Vault Contributor: This permission is required to create the key vault used for deployment.
   • Storage Account Contributor: This permission is required to create the storage account used for deployment.

5. In the right pane, go to Role assignments. Verify that the deployment user has all the configured roles.

Next steps

After setting up the subscription permissions, you can register your Azure Local machines with Azure Arc.

• Register using Azure Arc gateway.
• Register using Azure Arc.