diff --git a/dev-infrastructure/templates/e2e-subscription-rbac-assignment-subscription.bicep b/dev-infrastructure/templates/e2e-subscription-rbac-assignment-subscription.bicep
index 9d1327a42cf..0762d656732 100644
--- a/dev-infrastructure/templates/e2e-subscription-rbac-assignment-subscription.bicep
+++ b/dev-infrastructure/templates/e2e-subscription-rbac-assignment-subscription.bicep
@@ -82,6 +82,7 @@ resource msiMockRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
           'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read'
           'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write'
           'Microsoft.ManagedIdentity/userAssignedIdentities/read'
+          'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action'
           'Microsoft.Network/loadBalancers/backendAddressPools/read'
           'Microsoft.Network/loadBalancers/backendAddressPools/write'
           'Microsoft.Network/loadBalancers/read'
diff --git a/dev-infrastructure/templates/mock-identities.bicep b/dev-infrastructure/templates/mock-identities.bicep
index f992e38aaac..f2988131359 100644
--- a/dev-infrastructure/templates/mock-identities.bicep
+++ b/dev-infrastructure/templates/mock-identities.bicep
@@ -169,6 +169,7 @@ resource msiCustomRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
           'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read'
           'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write'
           'Microsoft.ManagedIdentity/userAssignedIdentities/read'
+          'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action' // attach customer-provided MIs (e.g. ACR pull) to VMs via CAPZ
           'Microsoft.Network/loadBalancers/backendAddressPools/read' // read backend address pools of LB to check if the backend address pool already exists
           'Microsoft.Network/loadBalancers/backendAddressPools/write' // write backend address pools to LB
           'Microsoft.Network/loadBalancers/read' // to check if LB exists or not before writing to it
diff --git a/dev-infrastructure/templates/mock-identity-roles.bicep b/dev-infrastructure/templates/mock-identity-roles.bicep
index ae62e77e51e..429c313a6a2 100644
--- a/dev-infrastructure/templates/mock-identity-roles.bicep
+++ b/dev-infrastructure/templates/mock-identity-roles.bicep
@@ -57,6 +57,7 @@ resource msiCustomRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' = {
           'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read'
           'Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write'
           'Microsoft.ManagedIdentity/userAssignedIdentities/read'
+          'Microsoft.ManagedIdentity/userAssignedIdentities/assign/action'
           'Microsoft.Network/loadBalancers/backendAddressPools/read'
           'Microsoft.Network/loadBalancers/backendAddressPools/write'
           'Microsoft.Network/loadBalancers/read'