Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected ...