> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/microsoft-azure-apis-ingested-by-prisma-cloud.md).
# Microsoft Azure APIs Ingested by Prisma Cloud
The following table lists all the Azure APIs that Prisma Cloud supports to retrieve data about the assets in your Azure cloud environment. It also lists all the required permissions for each Azure service.
## Azure Feature Permissions
| Feature | Permissions |
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| Current as of: | April 10, 2026 |
| Workload Discovery | Microsoft.ContainerRegistry/registries/read |
| | Microsoft.ContainerRegistry/registries/metadata/read |
| | Microsoft.ContainerRegistry/registries/pull/read |
| | Microsoft.ContainerService/managedClusters/read |
| | Microsoft.Web/sites/Read |
| | Microsoft.ContainerInstance/containerGroups/read |
| | Microsoft.ContainerInstance/containerGroups/containers/exec/action |
| | Microsoft.Compute/virtualMachines/read |
| | Microsoft.Compute/hostGroups/read |
| Threat Detection | Audit Logs |
| | Microsoft.Insights/ActivityLogAlerts/read |
| | Flow Logs |
| | Microsoft.Storage/storageAccounts/read |
| | Microsoft.Storage/storageAccounts/listKeys/action |
| | Microsoft.Network/networkInterfaces/read |
| | Microsoft.Network/networkSecurityGroups/read |
| | Microsoft.Network/networkWatchers/read |
| | Microsoft.Network/networkWatchers/securityGroupView/action |
| | Microsoft.Network/networkWatchers/queryFlowLogStatus/\* |
| | Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action |
| | Microsoft.Network/virtualwans/vpnconfiguration/action |
| | Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action |
| | Microsoft.Storage/storageAccounts/blobServices/containers/read |
| | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read |
| | Storage Blob Data Reader Role |
| | Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action
(Note: Azure has a known limitation on this API)
|
| | Microsoft.Storage/storageAccounts/blobServices/containers/read |
| | Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read |
| Agentless Scanning | Microsoft.Resources/subscriptions/resourceGroups/read |
| | Microsoft.Resources/subscriptions/resourceGroups/write |
| | Microsoft.Network/natGateways/read |
| | Microsoft.Network/natGateways/write |
| | Microsoft.Network/natGateways/delete |
| | Microsoft.Network/networkInterfaces/read |
| | Microsoft.Network/networkInterfaces/write |
| | Microsoft.Network/networkInterfaces/delete |
| | Microsoft.Network/networkInterfaces/join/action |
| | Microsoft.Network/networkSecurityGroups/read |
| | Microsoft.Network/networkSecurityGroups/write |
| | Microsoft.Network/networkSecurityGroups/delete |
| | Microsoft.Network/networkSecurityGroups/join/action |
| | Microsoft.Network/publicIPAddresses/read |
| | Microsoft.Network/publicIPAddresses/write |
| | Microsoft.Network/publicIPAddresses/delete |
| | Microsoft.Network/virtualNetworks/read |
| | Microsoft.Network/virtualNetworks/write |
| | Microsoft.Network/virtualNetworks/delete |
| | Microsoft.Network/virtualNetworks/subnets/read |
| | Microsoft.Network/virtualNetworks/subnets/join/action |
| | Microsoft.Compute/disks/read |
| | Microsoft.Compute/disks/write |
| | Microsoft.Compute/disks/delete |
| | Microsoft.Compute/disks/beginGetAccess/action |
| | Microsoft.Compute/snapshots/read |
| | Microsoft.Compute/snapshots/write |
| | Microsoft.Compute/snapshots/delete |
| | Microsoft.Compute/virtualMachines/read |
| Serverless Function Scanning | Microsoft.Compute/virtualMachines/write |
| | Microsoft.Compute/virtualMachines/delete |
| | Microsoft.Compute/virtualMachines/instanceView/read |
| | Microsoft.Compute/virtualMachineScaleSets/read |
| | Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read |
| Agent Based Workload Scanning | Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read |
| | Microsoft.Web/sites/read |
| | Microsoft.Web/sites/config/list/action |
| | Microsoft.web/sites/functions/action |
| | Microsoft.web/sites/functions/read |
| | Microsoft.Web/sites/publishxml/action |
| | Microsoft.Compute/virtualMachines/runCommand/action |
| | Microsoft.Compute/locations/operations/read |
| | Microsoft.Resources/subscriptions/locations/read |
| | Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/versions/read |
| | Microsoft.Compute/images/read |
| | Microsoft.Compute/galleries/read |
| | Microsoft.Compute/galleries/images/read |
| | Microsoft.Compute/galleries/images/versions/read |
| | Microsoft.Resources/subscriptions/resourceGroups/read |
| | Microsoft.Resources/subscriptions/resourceGroups/write |
| | Microsoft.Resources/subscriptions/resourceGroups/delete |
| | Microsoft.Network/networkSecurityGroups/read |
| | Microsoft.Network/networkSecurityGroups/write |
| | Microsoft.Network/networkSecurityGroups/join/action |
| | Microsoft.Network/networkSecurityGroups/delete |
| | Microsoft.Network/networkInterfaces/read |
| | Microsoft.Network/networkInterfaces/write |
| | Microsoft.Network/networkInterfaces/join/action |
| | Microsoft.Network/networkInterfaces/delete |
| | Microsoft.Compute/disks/write |
| | Microsoft.Compute/disks/delete |
| | Microsoft.Network/virtualNetworks/subnets/read |
| Remediation | Microsoft.Network/virtualNetworks/subnets/join/action |
| | Microsoft.Compute/virtualMachines/read |
| | Microsoft.Compute/virtualMachines/write |
| | Microsoft.Compute/virtualMachines/start/action |
| | Microsoft.Compute/virtualMachines/delete |
| | Built in Role: Key Vault Crypto Service Encryption User |
| | Microsoft.Web/sites/Write |
| | Microsoft.KeyVault/vaults/read |
| | Microsoft.Insights/LogProfiles/read |
| | Microsoft.Insights/LogProfiles/Write |
| | Microsoft.Insights/LogProfiles/Delete |
| | Microsoft.DBforPostgreSQL/servers/configurations/read |
| | Microsoft.DBforPostgreSQL/servers/configurations/write |
| | Microsoft.DBforMySQL/flexibleServers/configurations/write |
| | Microsoft.Sql/servers/databases/securityAlertPolicies/read |
| | Microsoft.Sql/servers/databases/securityAlertPolicies/write |
| | Microsoft.Web/sites/config/Write |
| | Microsoft.Storage/storageAccounts/write |
| | Microsoft.Authorization/policyAssignments/read |
| | Microsoft.Authorization/policyAssignments/write |
| | Microsoft.Authorization/policyAssignments/delete |
| | Microsoft.Sql/servers/databases/transparentDataEncryption/read |
| | Microsoft.Sql/servers/databases/transparentDataEncryption/write |
| | Microsoft.Network/networkSecurityGroups/securityRules/read |
| | Microsoft.Network/networkSecurityGroups/securityRules/write |
| | Microsoft.Network/networkSecurityGroups/securityRules/delete |
| | Microsoft.Security/autoProvisioningSettings/read |
| | Microsoft.Security/autoProvisioningSettings/write |
| | Microsoft.Storage/storageAccounts/\* |
## Azure Feature Permissions and APIs
| Service | API Name | Permissions |
| --------------------------------------------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Current as of: | April 10, 2026 | |
| Microsoft Entra ID (previously known as Azure Active Directory) | azure-active-directory-user | User.Read.All |
| Microsoft Entra ID | azure-active-directory-role-assignment-schedules | RoleAssignmentSchedule.Read.Directory |
| Microsoft Entra ID | azure-active-directory-conditional-access-policy | Policy.Read.All |
| Microsoft Entra ID | azure-active-directory-named-location | Policy.Read.All |
| Microsoft Entra ID | azure-active-directory-group | GroupMember.Read.All
Group.Read.All
|
| Microsoft Entra ID | azure-active-directory-authorization-policy | Policy.Read.All |
| Microsoft Entra ID | azure-active-directory-credential-user-registration-details | Reports.Read.All |
| Microsoft Entra ID | azure-active-directory-group-settings | Directory.Read.All |
| Microsoft Entra ID | azure-active-directory-enforcement-policy | Policy.Read.All |
| Microsoft Entra ID | azure-active-directory-custom-domain | Domain.Read.All |
| Microsoft Entra ID | azure-active-directory-service-principal-aws-app | Application.Read.All |
| Microsoft Entra ID | azure-active-directory-iam-group | GroupMember.Read.All
Group.Read.All
|
| Microsoft Entra ID | azure-active-directory-enterprise-applications | Application.Read.All |
| Microsoft Entra ID | azure-active-directory-service-principal-app | Application.Read.All |
| Microsoft Entra ID | azure-active-directory-app-registration | Application.Read.All |
| Microsoft Entra ID | azure-active-directory-b2c-tenants | Microsoft.AzureActiveDirectory/b2cDirectories/read |
| Microsoft Entra ID | azure-active-directory-directoryrole-definition | EntitlementManagement.Read.All
RoleManagement.Read.All
|
| Microsoft Entra ID | azure-active-directory-directoryrole-assignment | EntitlementManagement.Read.All
RoleManagement.Read.All
|
| Microsoft Entra ID | azure-active-directory-user-registration-details | AuditLog.Read.All |
| Microsoft Entra ID | azure-active-directory-authentication-strength-policy | Policy.Read.All |
| Microsoft Entra ID | azure-active-directory-admin-consent-request-policy | Policy.Read.All |
| Microsoft Entra ID | azure-active-directory-cross-tenant-access-default-settings | Policy.Read.All |
| Microsoft Entra ID | azure-active-directory-configured-external-identity-provider | IdentityProvider.Read.All |
| Microsoft Entra ID | azure-active-directory-authentication-methods-registration-campaign | Policy.Read.All |
| Microsoft Entra ID | azure-active-directory-subscribed-sku | Organization.Read.All |
| Azure Advisor | azure-advisor-configurations | Microsoft.Advisor/configurations/read |
| Azure Analysis Services | azure-analysisservices-servers | Microsoft.AnalysisServices/servers/read |
| Azure Analysis Services | azure-analysisservices-servers-diagnostic-settings | Microsoft.AnalysisServices/servers/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure API Management | azure-api-management-service | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/portalsettings/read
Microsoft.ApiManagement/service/tenant/read
|
| Azure API Management | azure-api-management-service-subscriptions | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/subscriptions/read
|
| Azure API Management Services | azure-api-management-service-diagnostic-settings | Microsoft.ApiManagement/service/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure API Management Services | azure-api-management-service-identity-provider | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/identityProviders/read
|
| Azure API Management Services | azure-api-management-service-alert-rules | Microsoft.Insights/MetricAlerts/Read |
| Azure API Management Services | azure-api-management-service-products | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/products/read
|
| Azure API Management Services | azure-api-management-service-api-policy | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/apis/read
Microsoft.ApiManagement/service/apis/policies/read
|
| Azure API Management Services | azure-api-management-service-product-policy | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/products/read
Microsoft.ApiManagement/service/products/policies/read
|
| Azure API Management Services | azure-api-management-service-apis | Microsoft.ApiManagement/service/apis/read |
| Azure API Management Services | azure-api-management-service-api-diagnostics | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/apis/diagnostics/read
|
| Azure API Management Services | azure-api-management-service-user | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/users/read
|
| Azure API Management Services | azure-api-management-service-openid-connect-provider | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/openidConnectProviders/read
|
| Azure API Management Services | azure-api-management-service-backend | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/backends/read
|
| Azure API Management Services | azure-api-management-service-authorization-server | Microsoft.ApiManagement/service/read
Microsoft.ApiManagement/service/authorizationServers/read
|
| Azure App Configuration | azure-appconfiguration-configuration-stores | Microsoft.AppConfiguration/configurationStores/read |
| Azure App Service | azure-app-service | Microsoft.Web/sites/read
Microsoft.Web/sites/config/read
Microsoft.Web/sites/functions/read
Microsoft.Web/sites/config/list/read
|
| Azure App Service | azure-app-service-certificate | Microsoft.Web/certificates/Read |
| Azure App Service | azure-app-service-domain | Microsoft.DomainRegistration/domains/Read |
| Azure App Service | azure-app-service-environment | Microsoft.Web/hostingEnvironments/Read |
| Azure App Service | azure-app-service-plan | Microsoft.Web/serverfarms/Read |
| Azure App Service | azure-app-service-deployment-slots | Microsoft.Web/sites/slots/Read
Microsoft.web/serverfarms/sites/read
Microsoft.Web/sites/slots/config/Read
|
| Azure App Service | azure-web-static-sites | Microsoft.Web/staticSites/read |
| Azure App Service | azure-app-service-diagnostic-settings | Microsoft.Web/sites/Read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure App Service | azure-app-service-web-apps-configurations | Microsoft.Web/sites/Read
Microsoft.Web/sites/config/Read
|
| Azure App Service | azure-app-service-basic-publishing-credentials-policies | Microsoft.Web/sites/Read
Microsoft.Web/sites/basicPublishingCredentialsPolicies/Read
|
| Azure App Service | azure-app-service-environment-diagnostic-settings | Microsoft.Web/hostingEnvironments/Read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure App Service | azure-app-service-private-endpoint-connections | Microsoft.Web/sites/Read
Microsoft.Web/sites/privateEndpointConnections/Read
|
| Azure App Service | azure-app-service-web-apps-functions | Microsoft.Web/sites/Read
Microsoft.web/sites/functions/read
|
| Azure App Service | azure-app-service-plan | Microsoft.Web/serverfarms/Read |
| Azure App Service | azure-app-service-plan-diagnostic-settings | Microsoft.Web/serverfarms/Read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure App Service | azure-app-service-connections | Microsoft.Web/connections/Read
Microsoft.Resources/subscriptions/resourceGroups/read
|
| Azure App Service | azure-app-service-web-apps-app-settings | Microsoft.Web/sites/Read
Microsoft.Web/sites/config/list/Action
|
| Azure Application Gateway | azure-application-gateway | Microsoft.Network/applicationGateways/read |
| Azure Application Insights | azure-application-insights-component | Microsoft.Insights/Components/read |
| Azure Application Insights | azure-application-insights-workbooks | Microsoft.Insights/Workbooks/Read |
| Azure Attestation | azure-attestation-providers | Microsoft.Attestation/attestationProviders/read |
| Azure Automanage | azure-automanage-configuration-profiles | Microsoft.Automanage/configurationProfiles/Read |
| Azure Automation Accounts | azure-automation-account | Microsoft.Automation/automationAccounts/read, Microsoft.Automation/automationAccounts/variables/read |
| Azure Automation Accounts | azure-automation-account-diagnostic-settings | Microsoft.Automation/automationAccounts/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Automation Accounts | azure-automation-account-hybrid-runbook-worker-groups | Microsoft.Automation/automationAccounts/read
Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read
|
| Azure Automation Accounts | azure-automation-account-runbooks | Microsoft.Automation/automationAccounts/read
Microsoft.Automation/automationAccounts/runbooks/read
|
| Azure Automation Accounts | azure-automation-account-credentials | Microsoft.Automation/automationAccounts/read
Microsoft.Automation/automationAccounts/credentials/read
|
| Azure Automation Accounts | azure-automation-account-hybrid-runbook-workers | Microsoft.Automation/automationAccounts/read
Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/hybridRunbookWorkers/read
|
| Azure Availability Sets | azure-vm-availability-set | Microsoft.Compute/availabilitySets/read |
| Azure Batch Account | azure-batch-account | Microsoft.Batch/batchAccounts/read |
| Azure Batch Account | azure-batch-account-diagnostic-settings | Microsoft.Batch/batchAccounts/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Batch Account | azure-batch-account-pool | Microsoft.Batch/batchAccounts/read
Microsoft.Batch/batchAccounts/pools/read
|
| Azure Batch Account | azure-batch-account-application | Microsoft.Batch/batchAccounts/read
Microsoft.Batch/batchAccounts/applications/read
|
| Azure Blueprints | azure-blueprints-list | Microsoft.Blueprint/blueprints/read |
| Azure Bot Service | azure-botservice-bots | Microsoft.BotService/botServices/read |
| Azure Cache for Redis | azure-cache-redis | Microsoft.Cache/redis/read, Microsoft.Cache/redis/firewallRules/read |
| Azure Cache for Redis | azure-cache-redis-diagnostic-settings | Microsoft.Cache/redis/read, Microsoft.Insights/DiagnosticSettings/Read |
| Azure Container Apps | azure-app-container-apps-managed-environment | Microsoft.app/managedenvironments/read |
| Azure Content Delivery Network | azure-cdn-profile | Microsoft.Cdn/profiles/read |
| Azure Content Delivery Network | azure-cdn-endpoint | Microsoft.Cdn/profiles/endpoints/read, Microsoft.Cdn/profiles/endpoints/customdomains/read |
| Azure Content Delivery Network | azure-frontdoor-standardpremium-origin-groups | Microsoft.Cdn/profiles/read
Microsoft.Cdn/profiles/origingroups/read
|
| Azure Content Delivery Network | azure-frontdoor-standardpremium-afd-endpoints | Microsoft.Cdn/profiles/read
Microsoft.Cdn/profiles/afdendpoints/read
|
| Azure Content Delivery Network | azure-frontdoor-standardpremium-security-policies | Microsoft.Cdn/profiles/read
Microsoft.Cdn/profiles/securitypolicies/read
|
| Azure Content Delivery Network | azure-frontdoor-standardpremium-routes | Microsoft.Cdn/profiles/read, Microsoft.Cdn/profiles/afdendpoints/read, Microsoft.Cdn/profiles/afdendpoints/routes/
read
|
| Azure Content Delivery Network | azure-frontdoor-standardpremium-afd-custom-
domains
| Microsoft.Cdn/profiles/read, Microsoft.Cdn/profiles/customdomains/read |
| Azure Content Delivery Network | azure-frontdoor-standardpremium-origin-groups-origin | Microsoft.Cdn/profiles/read
Microsoft.Cdn/profiles/origingroups/read
Microsoft.Cdn/profiles/origingroups/origins/read
|
| Azure Chaos Studio | azure-chaos-experiments | Microsoft.Chaos/experiments/read |
| Azure Cognitive Services | azure-cognitive-services-account | Microsoft.CognitiveServices/accounts/read |
| Azure Cognitive Services | azure-cognitive-search-service-diagnostic-settings | Microsoft.Search/searchServices/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Cognitive Services | azure-cognitive-search-service | Microsoft.Search/searchServices/read |
| Azure Cognitive Services | azure-cognitive-services-account-diagnostic-settings | Microsoft.CognitiveServices/accounts/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Communication Services | azure-communication-services | Microsoft.Communication/CommunicationServices/Read |
| Azure Compute | azure-disk-list | Microsoft.Compute/disks/read |
| Azure Compute | azure-virtual-machine-scale-set | Microsoft.Compute/virtualMachineScaleSets/read |
| Azure Compute | azure-virtual-machine-scale-set-vm | Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read
Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read
|
| Azure Compute | azure-vm-start-time | Microsoft.Compute/virtualMachines/read
Microsoft.Compute/virtualMachines/instanceView/read
|
| Azure Compute | azure-compute-dedicated-host-groups | Microsoft.Compute/hostGroups/read |
| Azure Compute | azure-cloudservices-list | Microsoft.Compute/cloudServices/read |
| Azure Compute | azure-cloudservices-roleinstance-publicip | Microsoft.Compute/cloudServices/read
Microsoft.Compute/cloudServices/roleInstances/read
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipConfigurations/publicIPAddresses/read
|
| Azure Compute | azure-compute-gallery | Microsoft.Compute/galleries/read |
| Azure Compute | azure-compute-gallery-image | Microsoft.Compute/galleries/read
Microsoft.Compute/galleries/images/read
|
| Azure Compute | azure-compute-disk-encryption-sets | Microsoft.Compute/diskEncryptionSets/read |
| Azure Compute | azure-compute-snapshots | Microsoft.Compute/snapshots/read |
| Azure Compute | azure-compute-proximity-placement-groups | Microsoft.Compute/proximityPlacementGroups/read |
| Azure Compute | azure-compute-restore-point-collections | Microsoft.Compute/restorePointCollections/read |
| Azure Confidential Ledger | azure-confidential-ledgers | Microsoft.ConfidentialLedger/ledgers/read |
| Azure Confluent | azure-confluent-organizations | Microsoft.Confluent/organizations/Read |
| Azure Container Apps | azure-app-container-apps | Microsoft.app/containerapps/read |
| Azure Container Instances | azure-container-instances-container-group | Microsoft.ContainerInstance/containerGroups/read |
| Azure Container Registry | azure-container-registry | Microsoft.ContainerRegistry/registries/read
Microsoft.ContainerRegistry/registries/metadata/read
Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action
Microsoft.insights/diagnosticSettings/read
|
| Azure Container Registry | azure-container-registry-repository | Microsoft.ContainerInstance/containerGroups/read |
| Azure Container Registry | azure-container-registry-cache-rules | Microsoft.ContainerRegistry/registries/read
Microsoft.ContainerRegistry/registries/cacheRules/read
|
| Azure Cosmos DB | azure-cosmos-db | Microsoft.DocumentDB/databaseAccounts/read
Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action
Microsoft.DocumentDB/databaseAccounts/readonlykeys/action
Microsoft.DocumentDB/databaseAccounts/listKeys/action
|
| Azure Cosmos DB | azure-documentdb-cassandra-clusters | Microsoft.DocumentDB/cassandraClusters/read |
| Azure Cosmos DB | azure-cosmos-db-diagnostic-settings | Microsoft.DocumentDB/databaseAccounts/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Cosmos DB | azure-documentdb-cassandra-clusters-diagnostic-settings | Microsoft.DocumentDB/cassandraClusters/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Data Box Gateway | azure-databox-gateway | Microsoft.DataBoxEdge/dataBoxEdgeDevices/read |
| Azure Data Catalog | azure-datacatalog-catalog | Microsoft.DataCatalog/catalogs/read |
| Azure Data Factory | azure-data-factory-v1 | Microsoft.DataFactory/datafactories/read |
| Azure Data Factory | azure-data-factory-v2 | Microsoft.DataFactory/factories/read |
| Azure Data Factory | azure-data-factory-v2-linked-services | Microsoft.DataFactory/factories/read
Microsoft.DataFactory/factories/linkedservices/read
|
| Azure Data Factory | azure-data-factory-v2-integration-runtimes | Microsoft.DataFactory/factories/read
Microsoft.DataFactory/factories/integrationruntimes/read
|
| Azure Data Protection | azure-data-protection-backup-vaults | Microsoft.DataProtection/backupVaults/read |
| Azure Data Protection | azure-data-protection-backup-instances | Microsoft.DataProtection/backupVaults/read
Microsoft.DataProtection/backupVaults/backupInstances/read
|
| Azure Data Protection | azure-data-protection-backup-policies | Microsoft.DataProtection/backupVaults/read
Microsoft.DataProtection/backupVaults/backupPolicies/read
|
| Azure Data Protection | azure-data-protection-jobs | Microsoft.DataProtection/backupVaults/read
Microsoft.DataProtection/backupVaults/backupJobs/read
|
| Azure Data Protection | azure-data-protection-recovery-points | Microsoft.DataProtection/backupVaults/read
Microsoft.DataProtection/backupVaults/backupInstances/read
Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read
|
| Azure Data Share | azure-data-shares-account | Microsoft.DataShare/accounts/read |
| Azure Database for MariaDB Server | azure-database-maria-db-server | Microsoft.DBforMariaDB/servers/read |
| Azure Database for MariaDB Server | azure-database-maria-db-server-diagnostic-settings | Microsoft.DBforMariaDB/servers/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Database for MariaDB Server | azure-database-maria-db-server-firewall-rules | Microsoft.DBforMariaDB/servers/read
Microsoft.DBforMariaDB/servers/firewallRules/read
|
| Azure Database for MySQL | azure-mysql-server | Microsoft.DBforMySQL/servers/read
Microsoft.DBforMySQL/servers/firewallRules/read
Microsoft.DBforMySQL/servers/virtualNetworkRules/read
|
| Azure Database for MySQL | azure-mysql-flexible-server | Microsoft.DBforMySQL/flexibleServers/read
Microsoft.DBforMySQL/flexibleServers/firewallRules/read
Microsoft.DBforMySQL/flexibleServers/configurations/read
|
| Azure Database for MySQL | azure-mysql-flexible-server-diagnostic-settings | Microsoft.DBforMySQL/flexibleServers/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Database for MySQL | azure-mysql-flexible-server-database | Microsoft.DBforMySQL/flexibleServers/read
Microsoft.DBforMySQL/flexibleServers/databases/read
|
| Azure Database for PostgreSQL | azure-postgresql-server | Microsoft.DBforPostgreSQL/servers/read
Microsoft.DBforPostgreSQL/servers/firewallRules/read
Microsoft.DBforPostgreSQL/serversv2/firewallRules/read
Microsoft.DBforPostgreSQL/servers/configurations/read
Microsoft.insights/diagnosticSettings/read
|
| Azure Database for PostgreSQL | azure-postgresql-flexible-server | Microsoft.DBforPostgreSQL/flexibleServers/read
Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read
Microsoft.DBforPostgreSQL/flexibleServers/configurations/read
|
| Azure Database for PostgreSQL | azure-postgresql-flexible-server-diagnostic-settings | Microsoft.DBforPostgreSQL/flexibleServers/read,
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Database for PostgreSQL | azure-postgresql-flexible-server-database | Microsoft.DBforPostgreSQL/flexibleServers/read
Microsoft.DBforPostgreSQL/flexibleServers/databases/read
|
| Azure Database for PostgreSQL | azure-postgresql-flexible-server-configurations | Microsoft.DBforPostgreSQL/flexibleServers/read
Microsoft.DBforPostgreSQL/flexibleServers/configurations/read
|
| Azure Database Migration Projects | azure-database-migration-project | Microsoft.DataMigration/services/read |
| Azure Databricks | azure-databricks-diagnostic-settings | Microsoft.Databricks/workspaces/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Databricks | azure-databricks-workspace | Microsoft.Databricks/workspaces/read |
| Azure Databricks | azure-databricks-access-connectors | Microsoft.Databricks/accessConnectors/read |
| Azure Datadog | azure-datadog-monitors | Microsoft.Datadog/monitors/read |
| Azure Defender for Cloud | azure-iot-security-solutions | Microsoft.Security/iotSecuritySolutions/read |
| Azure Defender for Cloud | azure-defender-for-cloud-security-contact | Microsoft.Security/securityContacts/read |
| Azure Defender for Cloud | azure-defender-for-cloud-setting | Microsoft.Security/settings/read |
| Azure Defender for Cloud | azure-defender-for-cloud-workspace-setting | Microsoft.Security/workspaceSettings/read |
| Azure Defender for Cloud | azure-defender-for-cloud-automation | Microsoft.Security/automations/read |
| Azure Defender for Cloud | azure-defender-for-cloud-location | Microsoft.Security/locations/read |
| Azure Defender for Cloud | azure-defender-for-cloud-pricing | Microsoft.Security/pricings/read |
| Azure Defender for Cloud | azure-defender-for-cloud-jit-network-access-policies | Microsoft.Security/locations/jitNetworkAccessPolicies/read |
| Azure Dev Center | azure-dev-centers | Microsoft.DevCenter/devcenters/read |
| Azure Dev Test Labs | azure-devtestlab-global-schedules | Microsoft.DevTestLab/schedules/read |
| Azure DevOps | azure-devops-pipelines | Microsoft.DevOps/pipelines/read |
| Azure Digital Twins | azure-digital-twins | Microsoft.DigitalTwins/digitalTwinsInstances/read |
| Azure DNS | azure-dns-zones | Microsoft.Network/dnsZones/read |
| Azure DNS | azure-dns-privatedns-zones | Microsoft.Network/privateDnsZones/read |
| Azure DNS | azure-dns-private-dns-zone-record-sets | Microsoft.Network/privateDnsZones/read
Microsoft.Network/privateDnsZones/ALL/read
|
| Azure DNS | azure-dns-recordsets | Microsoft.Network/dnsZones/recordsets/read |
| Azure Elastic | azure-elastic-monitors | Microsoft.Elastic/monitors/read |
| Azure Event Grid | azure-event-grid-domains | Microsoft.EventGrid/domains/read |
| Azure Event Grid | azure-event-grid-topic | Microsoft.EventGrid/topics/read |
| Azure Event Grid | azure-event-grid-topic-privatelinkresource | Microsoft.EventGrid/topics/read
Microsoft.EventGrid/topics/privateLinkResources/read
|
| Azure Event Grid | azure-event-grid-domains-privatelinkresource | Microsoft.EventGrid/domains/read
Microsoft.EventGrid/domains/privateLinkResources/read
|
| Azure Event Grid | azure-event-grid-namespaces | Microsoft.EventGrid/namespaces/read |
| Azure Event Grid | azure-event-grid-partner-namespaces | Microsoft.EventGrid/partnerNamespaces/read |
| Azure Event Grid | azure-event-grid-topic-diagnostic-settings | Microsoft.EventGrid/topics/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Event Hubs | azure-event-hub-namespace | Microsoft.EventHub/namespaces/read
Microsoft.EventHub/namespaces/authorizationRules/read
Microsoft.EventHub/namespaces/virtualnetworkrules/read
Microsoft.EventHub/namespaces/ipfilterrules/read
Microsoft.EventHub/namespaces/networkrulesets/read
|
| Azure Event Hubs | azure-event-hub | Microsoft.EventHub/namespaces/eventhubs/read
Microsoft.EventHub/namespaces/eventhubs/authorizationRules/read
|
| Azure Event Hubs | azure-event-hub-namespace-private-endpoint-connections | Microsoft.EventHub/Namespaces/PrivateEndpointConnections/read |
| Azure Event Hubs | azure-event-hub-cluster | Microsoft.EventHub/clusters/read |
| Azure Event Hubs | azure-event-hub-namespace-diagnostic-settings | Microsoft.EventHub/namespaces/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Express Route | azure-express-route-circuit-diagnostic-settings | Microsoft.Network/expressRouteCircuits/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Fluid Relay | azure-fluid-relay-server | Microsoft.FluidRelay/fluidRelayServers/read |
| Azure Front Door | azure-frontdoor | Microsoft.Network/frontDoors/read
Microsoft.Network/frontDoors/routingRules/read
Microsoft.Network/frontDoors/backendPools/read
Microsoft.Network/frontDoors/frontendEndpoints/read
Microsoft.Network/frontDoors/healthProbeSettings/read
Microsoft.Network/frontDoors/loadBalancingSettings/read
Microsoft.Network/frontDoors/rulesEngines/read
|
| Azure HDInsight | azure-hdinsight-cluster | Microsoft.HDInsight/clusters/read |
| Azure HDInsight | azure-hdinsight-applications | Microsoft.HDInsight/clusters/read
Microsoft.HDInsight/clusters/applications/read
|
| Azure Health Bot | azure-healthbot-bots | Microsoft.HealthBot/healthBots/Read |
| Azure Healthcare Apis | azure-healthcare-apis-workspaces | Microsoft.HealthcareApis/workspaces/read |
| Azure HPC Cache | azure-hpc-cache | Microsoft.StorageCache/caches/read
Microsoft.StorageCache/Subscription/caches/read
|
| Azure Hybrid Compute | azure-hybridcompute-machines | Microsoft.HybridCompute/machines/read |
| Azure IoT Central | azure-iot-central-apps | Microsoft.IoTCentral/IoTApps/read |
| Azure IoT Hub | azure-devices-iot-hub-resource | Microsoft.Devices/iotHubs/Read |
| Azure IoT Hub | azure-devices-iot-hub-privatelinkresource | Microsoft.Devices/iotHubs/Read
Microsoft.Devices/iotHubs/privateLinkResources/Read
|
| Azure IoT Hub | azure-devices-iot-hub-resource-diagnostic-settings | Microsoft.Devices/iotHubs/Read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Key Vault | azure-key-vault-list | Microsoft.KeyVault/vaults/read
Microsoft.KeyVault/vaults/keys/read
Microsoft.KeyVault/vaults/certificates/read
Microsoft.KeyVault/vaults/secrets/readMetadata/action
Microsoft.insights/diagnosticSettings/read
|
| Azure Key Vault | azure-key-vault-certificate | Microsoft.KeyVault/vaults/read
Microsoft.KeyVault/vaults/certificates/read
NOTE: Application certificate read permssion is required, if the application is part of the onboarded account.
|
| Azure Key Vault | azure-key-vault-privatelinkresource | Microsoft.KeyVault/vaults/read
Microsoft.KeyVault/vaults/privateLinkResources/read
|
| Azure Key Vault | azure-key-vault-diagnostic-settings | Microsoft.KeyVault/vaults/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Key Vault | azure-key-vault-managed-hsms-diagnostic-settings | Microsoft.KeyVault/managedHSMs/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Key Vault | azure-key-vault-managed-hsms | Microsoft.KeyVault/managedHSMs/read |
| Azure Kubernetes Service | azure-kubernetes-cluster | Microsoft.ContainerService/managedClusters/read |
| Azure Kubernetes Service | azure-kubernetes-cluster-diagnostic-settings | Microsoft.ContainerService/managedClusters/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Kubernetes Service | azure-kubernetes-connected-cluster | Microsoft.Kubernetes/connectedClusters/Read |
| Azure Kusto | azure-kusto-clusters | Microsoft.Kusto/Clusters/read |
| Azure Kusto | azure-kusto-databases | Microsoft.Kusto/Clusters/read
Microsoft.Kusto/Clusters/Databases/read
|
| Azure Kusto | azure-kusto-clusters-diagnostic-settings | Microsoft.Kusto/Clusters/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Lab Services | azure-labservices-labs | Microsoft.LabServices/labs/read |
| Azure Load Balancer | azure-network-lb-list | Microsoft.Network/loadBalancers/read
Microsoft.insights/diagnosticSettings/read
|
| Azure Load Testing | azure-loadtest-service-load-tests | Microsoft.LoadTestService/loadTests/read |
| Azure Load Testing | azure-loadtest-service-outbound-network-endpoint | Microsoft.LoadTestService/loadTests/read
Microsoft.LoadTestService/loadTests/outboundNetworkDependenciesEndpoints/read
|
| Azure Local Network Gateways | azure-local-network-gateways | Microsoft.Network/localnetworkgateways/read |
| Azure Log Analytics | azure-log-analytics-workspace | Microsoft.OperationalInsights/workspaces/read |
| Azure Log Analytics | azure-log-analytics-linked-storage-accounts | Microsoft.OperationalInsights/workspaces/read
Microsoft.OperationalInsights/workspaces/storageinsightconfigs/read
|
| Azure Log Analytics | azure-log-analytics-clusters | Microsoft.OperationalInsights/clusters/read |
| Azure Log Analytics | azure-log-analytics-workspace-tables | Microsoft.OperationalInsights/workspaces/read
Microsoft.OperationalInsights/workspaces/tables/read
|
| Azure Logic Apps | azure-logic-app-workflow | Microsoft.Web/customApis |
| Azure Logic Apps | azure-logic-app-custom-connector | Microsoft.Web/customApis |
| Azure Logic Apps | azure-logic-app-integration-account | Microsoft.Logic/integrationAccounts/read |
| Azure Logic Apps | azure-logic-app-workflow-diagnostic-settings | Microsoft.Logic/workflows/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Logic Apps | azure-logic-app-workflow-versions | Microsoft.Logic/workflows/read
Microsoft.Logic/workflows/versions/read
|
| Azure Machine Learning | azure-machine-learning-workspace | Microsoft.MachineLearningServices/workspaces/read |
| Azure Machine Learning | azure-machine-learning-compute | Microsoft.MachineLearningServices/workspaces/read
Microsoft.MachineLearningServices/workspaces/computes/read
|
| Azure Machine Learning | azure-machine-learning-workspace-managed-network-outbound-rules | Microsoft.MachineLearningServices/workspaces/read
Microsoft.MachineLearningServices/workspaces/outboundRules/read
|
| Azure Machine Learning | azure-machine-learning-workspace-diagnostic-settings | Microsoft.MachineLearningServices/workspaces/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Managed Applications | azure-solutions-applications | Microsoft.Solutions/applications/read |
| Azure Managed Grafana | azure-dashboard-grafana | Microsoft.Dashboard/grafana/read |
| Azure Managed Identity | azure-managed-identity-user-assigned-identities | Microsoft.ManagedIdentity/userAssignedIdentities/read |
| Azure Managed Services | azure-managedservices-registration-assignments | Microsoft.ManagedServices/registrationAssignments/read |
| Azure Management Group | azure-management-group-entities-list | Microsoft.Resources/subscriptions/read
Microsoft.Management/managementGroups/descendants/read
Microsoft.PowerBIDedicated/capacities/read
|
| Azure Maps Management | azure-maps-accounts | Microsoft.Maps/accounts/read |
| Azure Mixed Reality | azure-mixed-reality-object-anchors-accounts | Microsoft.MixedReality/ObjectAnchorsAccounts/read |
| Azure Monitor | azure-monitor-log-profiles-list | Microsoft.Insights/LogProfiles/read |
| Azure Monitor | azure-activity-log-alerts | Microsoft.Insights/ActivityLogAlerts/read |
| Azure Monitor | azure-monitor-action-groups | Microsoft.Insights/ActionGroups/Read |
| Azure Monitor | azure-monitor-smart-detector-alert-rules | Microsoft.AlertsManagement/smartDetectorAlertRules/read |
| Azure Monitor | azure-monitor-prometheus-rule-groups | Microsoft.AlertsManagement/prometheusRuleGroups/read |
| Azure Monitor | azure-monitor-query-packs | Microsoft.OperationalInsights/querypacks/read |
| Azure Monitor | azure-monitor-data-collection-rules | Microsoft.Insights/DataCollectionRules/Read |
| Azure Monitor | azure-monitor-workspaces | Microsoft.Monitor/Accounts/Read |
| Azure NetApp Files | azure-netappfiles-account | Microsoft.NetApp/netAppAccounts/read |
| Azure NetApp Files | azure-netappfiles-volumes | Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read
Microsoft.NetApp/netAppAccounts/read
Microsoft.NetApp/netAppAccounts/capacityPools/read
|
| Azure Network Function | azure-network-function-traffic-collectors | Microsoft.NetworkFunction/azureTrafficCollectors/read |
| Azure Network Manager | azure-network-manager | Microsoft.Network/networkManagers/read |
| Azure Network Manager | azure-network-manager-network-group | Microsoft.Network/networkManagers/read
Microsoft.Network/networkManagers/networkGroups/read
|
| Azure Network Manager | azure-network-manager-security-admin-configuration | Microsoft.Network/networkManagers/read
Microsoft.Network/networkManagers/securityAdminConfigurations/read
|
| Azure Network Manager | azure-network-manager-static-members | Microsoft.Network/networkManagers/read
Microsoft.Network/networkManagers/networkGroups/read
Microsoft.Network/networkManagers/networkGroups/staticMembers/read
|
| Azure Network Watcher | azure-network-watcher-list | Microsoft.Network/networkWatchers/read
Microsoft.Network/networkWatchers/securityGroupView/action
Microsoft.Network/networkWatchers/queryFlowLogStatus/action
|
| Azure Network Watcher | azure-network-watcher-flowlogs | Microsoft.Network/networkWatchers/read
Microsoft.Network/networkWatchers/configureFlowLog/action
Microsoft.Network/networkWatchers/flowLogs/read
|
| Azure Notification Hubs | azure-notification-hub-namespace | Microsoft.NotificationHubs/Namespaces/read |
| Azure Notification Hubs | azure-notification-hub | Microsoft.NotificationHubs/Namespaces/NotificationHubs/read |
| Azure Notification Hubs | azure-notification-hub-namespace-diagnostic-settings | Microsoft.NotificationHubs/Namespaces/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Orbital | azure-orbital-spacecrafts | Microsoft.Orbital/spacecrafts/read |
| Azure Policy | azure-policy-assignments | Microsoft.Authorization/policyAssignments/read |
| Azure Policy | azure-policy-definition | Microsoft.Authorization/policyDefinitions/read |
| Azure Power BI Embedded | azure-powerbi-dedicated-capacities | Microsoft.PowerBIDedicated/servers/read
Microsoft.PowerBIDedicated/capacities/read
|
| Azure Power BI Embedded | azure-powerbi-dedicated-capacities-diagnostic-settings | Microsoft.PowerBIDedicated/servers/read
Microsoft.PowerBIDedicated/capacities/read
|
| Azure Purview | azure-purview-account | Microsoft.Purview/accounts/read
Microsoft.Purview/getDefaultAccount/read
Microsoft.Purview/accounts/privateEndpointConnections/read
|
| Azure Purview | azure-purview-default-account | Microsoft.Purview/accounts/read
Microsoft.Purview/getDefaultAccount/read
Microsoft.Resources/subscriptions/read
|
| Azure Purview | azure-purview-privatelinkresource | Microsoft.Purview/accounts/privatelinkresources/read |
| Azure Quantum | azure-quantum-workspace | Microsoft.Quantum/Workspaces/Read |
| Azure Recovery Services | azure-recovery-service-vault | Microsoft.RecoveryServices/Vaults/read |
| Azure Recovery Services | azure-recovery-service-backup-protected-item | Microsoft.RecoveryServices/Vaults/backupProtectedItems/read |
| Azure Recovery Services | azure-recovery-service-vault-diagnostic-settings | Microsoft.RecoveryServices/Vaults/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Recovery Services | azure-recovery-service-vault-backup-policies | Microsoft.RecoveryServices/Vaults/read
Microsoft.RecoveryServices/vaults/backupPolicies/read
|
| Azure Recovery Services | azure-recovery-service-site-recovery-protected-item | Microsoft.RecoveryServices/Vaults/read
Microsoft.RecoveryServices/vaults/replicationProtectedItems/read
|
| Azure Red Hat OpenShift | azure-redhat-openshift-cluster | Microsoft.RedHatOpenShift/openShiftClusters/read |
| Azure Relay | azure-relay-namespaces | Microsoft.Relay/Namespaces/read |
| Azure Resource Manager | azure-resource-group | Microsoft.Resources/subscriptions/resourceGroups/read |
| Azure Resource Manager | azure-role-definition | Microsoft.Authorization/roleDefinitions/read |
| Azure Resource Manager | azure-role-assignment | Microsoft.Authorization/roleAssignments/read |
| Azure Resource Manager | azure-classic-resource | Microsoft.Authorization/classicAdministrators/read |
| Azure Resource Mover | azure-migrate-move-collections | Microsoft.Migrate/moveCollections/read |
| Azure Resource Manager | azure-template-specs | Microsoft.Resources/templateSpecs/read |
| Azure Security Center | azure-security-center-settings | Microsoft.Security/pricings/read
Microsoft.Security/securityContacts/read
Microsoft.Security/settings/read
|
| Azure Service Bus | azure-service-bus-namespace | Microsoft.ServiceBus/namespaces/read
Microsoft.ServiceBus/namespaces/authorizationRules/read
Microsoft.ServiceBus/namespaces/providers/Microsoft.Insights/diagnosticSettings/read
Microsoft.ServiceBus/namespaces/networkrulesets/read
|
| Azure Service Bus | azure-service-bus-namespace-private-endpoint-connection | Microsoft.ServiceBus/namespaces/privateEndpointConnections/read |
| Azure Service Bus | azure-service-bus-queue | Microsoft.ServiceBus/namespaces/queues/read |
| Azure Service Bus | azure-service-bus-topic | Microsoft.ServiceBus/namespaces/topics/read |
| Azure Service Bus | azure-service-bus-topic-subscription | Microsoft.ServiceBus/namespaces/topics/subscriptions/read |
| Azure Service Fabric | azure-service-fabric-cluster | Microsoft.ServiceFabric/clusters/read |
| Azure SignalR Service | azure-signalr | Microsoft.SignalRService/SignalR/read |
| Azure Spring Cloud | azure-spring-cloud-service | Microsoft.AppPlatform/Spring/read |
| Azure Spring Cloud | azure-spring-cloud-app | Microsoft.AppPlatform/Spring/apps/read |
| Azure SQL Database | azure-sql-db-list | Microsoft.Sql/servers/databases/read
Microsoft.Sql/servers/databases/securityAlertPolicies/read
Microsoft.Sql/servers/databases/transparentDataEncryption/read
Microsoft.Sql/servers/databases/auditingSettings/read
Microsoft.insights/diagnosticSettings/read
|
| Azure SQL Database | azure-sql-server-list | Microsoft.Sql/servers/read
Microsoft.Sql/servers/securityAlertPolicies/read
Microsoft.Sql/servers/auditingSettings/read
Microsoft.Sql/servers/administrators/read
Microsoft.Sql/servers/encryptionProtector/read
Microsoft.Sql/servers/firewallRules/read
|
| Azure SQL Database | azure-sql-managed-instance | Microsoft.Sql/managedInstances/read |
| Azure SQL Database | azure-sql-managed-instance-diagnostic-settings | Microsoft.Sql/managedInstances/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure SQL Database | azure-sql-db-diagnostic-settings | Microsoft.Sql/servers/read
Microsoft.Sql/servers/databases/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure SQL Database | azure-sql-db-long-term-retention-policies | Microsoft.Sql/servers/read
Microsoft.Sql/servers/databases/read
Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies/read
|
| Azure SQL Database | azure-sql-managed-instance-vulnerability-
assessments
| Microsoft.Sql/managedInstances/read
Microsoft.Sql/managedInstances/vulnerabilityAssessments/Read
|
| Azure SQL Database | azure-sql-managed-instance-encryption- | Microsoft.Sql/managedInstances/read
Microsoft.Sql/managedInstances/encryptionProtector/Read
|
| Azure SQL Database | azure-sql-vm | Microsoft.SqlVirtualMachine/sqlVirtualMachines/read |
| Azure SQL Database | azure-sql-db-data-masking-policies | Microsoft.Sql/servers/read
Microsoft.Sql/servers/databases/read
Microsoft.Sql/servers/databases/dataMaskingPolicies/read
|
| Azure SQL Database | azure-sql-db-transparent-data-encryption | Microsoft.Sql/managedInstances/read
Microsoft.Sql/managedInstances/databases/read
Microsoft.Sql/managedInstances/databases/transparentDataEncryption/read
|
| Azure SQL Database | azure-sql-db-data-masking-rules | Microsoft.Sql/servers/read
Microsoft.Sql/servers/databases/read
Microsoft.Sql/servers/databases/dataMaskingPolicies/rules/read
|
| Azure Stack HCI | protectors | Microsoft.AzureStackHCI/Clusters/Read |
| Azure Storage | azure-storage-account-list | Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/listKeys/action
Microsoft.Storage/storageAccounts/tableServices/read
Microsoft.Storage/storageAccounts/queueServices/read
Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/read
Microsoft.insights/diagnosticSettings/read
|
| Azure Storage | azure-storage-account-diagnostic-settings | Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/listKeys/action
Microsoft.Storage/storageAccounts/tableServices/read
Microsoft.Storage/storageAccounts/queueServices/read
Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/read
Microsoft.insights/diagnosticSettings/read
|
| Azure Storage | azure-storage-account-table-diagnostic-settings | Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/tableServices/read
Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/read
|
| Azure Storage | azure-storage-account-queue-diagnostic-settings | Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/queueServices/read
Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/read
|
| Azure Storage | azure-storage-account-file-diagnostic-settings | Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/fileServices/read
Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/read
|
| Azure Storage | azure-storage-account-blob-diagnostic-settings | Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/blobServices/read
Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/read
|
| Azure Storage | azure-storage-account-keys | Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/listKeys/action
|
| Azure Storage | azure-storage-file-shares | Microsoft.Storage/storageAccounts/fileServices/shares/read |
| Azure Storage | azure-storage-account-blob-container | Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/blobServices/containers/read
|
| Azure Storage | azure-storage-account-file-service-property | Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/fileServices/read
|
| Azure Storage Mover | azure-storage-movers | Microsoft.StorageMover/storageMovers/read |
| Azure Storage Sync Services | azure-storage-sync-service | Microsoft.StorageSync/storageSyncServices/read |
| Azure Storage Sync Services | azure-storage-sync-service-privatelinkresource | Microsoft.StorageSync/storageSyncServices/read
Microsoft.StorageSync/storageSyncServices/privateLinkResources/read
|
| Azure StorSimple | azure-storsimple-managers | Microsoft.StorSimple/managers/read |
| Azure Stream Analytics | azure-streamanalytics-clusters | Microsoft.StreamAnalytics/clusters/Read |
| Azure Stream Analytics | azure-streamanalytics-streamingjobs | Microsoft.StreamAnalytics/streamingjobs/Read |
| Azure Stream Analytics | azure-streamanalytics-streamingjobs-diagnostic-settings | Microsoft.StreamAnalytics/streamingjobs/Read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Subscriptions | azure-subscription-resource-providers-registration-status | Microsoft.Resources/subscriptions/providers/read |
| Azure Subscriptions | azure-subscription-tenantpolicy | Microsoft.Subscription/Policies/default/read |
| Azure Subscriptions | azure-subscription-list | Microsoft.Resources/subscriptions/read |
| Azure Synapse Analytics | azure-synapse-privatelinkhub-privatelinkresource | Microsoft.Synapse/privateLinkHubs/privateLinkResources/read |
| Azure Synapse Analytics | azure-synapse-privatelinkresource | Microsoft.Synapse/workspaces/read
Microsoft.Synapse/workspaces/privateLinkResources/read
|
| Azure Synapse Analytics | azure-synapse-privatelinkhub | Microsoft.Synapse/privateLinkHubs/read |
| Azure Synapse Analytics | azure-synapse-spark-configuration | Microsoft.Synapse/workspaces/read
Microsoft.Synapse/workspaces/sparkConfigurations/read
|
| Azure Synapse Analytics | azure-synapse-workspace | Microsoft.Synapse/workspaces/read |
| Azure Synapse Analytics | azure-synapse-workspace-managed-sql-server-vulnerability-assessments | Microsoft.Synapse/workspaces/read
Microsoft.Synapse/workspaces/vulnerabilityAssessments/read
|
| Azure Synapse Analytics | azure-synapse-workspace-managed-sql-server-blob-auditing-policies | Microsoft.Synapse/workspaces/read
Microsoft.Synapse/workspaces/auditingSettings/read
|
| Azure Synapse Analytics | azure-synapse-workspace-ip-firewall-rules | Microsoft.Synapse/workspaces/read
Microsoft.Synapse/workspaces/firewallRules/read
|
| Azure Synapse Analytics | azure-synapse-workspace-sql-pools | Microsoft.Synapse/workspaces/read
Microsoft.Synapse/workspaces/sqlPools/read
|
| Azure Synapse Analytics | azure-synapse-workspace-diagnostic-settings | Microsoft.Synapse/workspaces/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Synapse Analytics | azure-synapse-workspace-sql-pools-geo-backup-policies | Microsoft.Synapse/workspaces/read
Microsoft.Synapse/workspaces/sqlPools/read
Microsoft.Synapse/workspaces/sqlPools/geoBackupPolicies/read
|
| Azure Time Series Insights | | Microsoft.TimeSeriesInsights/environments/read |
| Azure Traffic Manager | azure-traffic-manager-profile | Microsoft.Network/trafficManagerProfiles/read |
| Azure Video Indexer | azure-video-indexer-accounts | Microsoft.VideoIndexer/accounts/read |
| Azure Virtual Desktop | azure-virtual-desktop-workspace | Microsoft.DesktopVirtualization/workspaces/read
Microsoft.DesktopVirtualization/workspaces/providers/Microsoft.Insights/diagnosticSettings/read
|
| Azure Virtual Desktop | azure-virtual-desktop-session-host | Microsoft.DesktopVirtualization/hostpools/read
Microsoft.DesktopVirtualization/hostpools/sessionhosts/read
Microsoft.DesktopVirtualization/hostpools/sessionhostconfigurations/read
|
| Azure Virtual Desktop | azure-virtual-desktop-application-groups | Microsoft.DesktopVirtualization/applicationgroups/read |
| Azure Virtual Network | azure-network-vnet-list | Microsoft.Network/virtualNetworks/read
Microsoft.Network/virtualNetworks/subnets/read
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read
Microsoft.insights/diagnosticSettings/read
|
| Azure Virtual Network | azure-network-nic-list | Microsoft.Network/networkInterfaces/read
Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action
|
| Azure Virtual Network | azure-network-nsg-list | Microsoft.Network/networkSecurityGroups/read
Microsoft.Network/networkSecurityGroups/securityRules/read
Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read
microsoft.insights/diagnosticSettings/read
|
| Azure Virtual Network | azure-network-subnet-list | Microsoft.Network/virtualNetworks/subnets/read, |
| Azure Virtual Network | azure-network-peering | Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read |
| Azure Virtual Network | azure-network-route-table | Microsoft.Network/routeTables/read
Microsoft.Network/routeTables/routes/read
|
| Azure Virtual Network | azure-network-application-security-group | Microsoft.Network/applicationSecurityGroups/read, |
| Azure Virtual Network | azure-network-firewall | Microsoft.Network/azurefirewalls/read
Microsoft.insights/diagnosticSettings/read
|
| Azure Virtual Network | azure-network-usage | Microsoft.Network/locations/usages/read |
| Azure Virtual Network | azure-network-public-ip-address | Microsoft.Network/publicIPAddresses/read
Microsoft.insights/diagnosticSettings/read
|
| Azure Virtual Network | azure-ddos-protection-plan | Microsoft.Network/ddosProtectionPlans/read |
| Azure Virtual Network | azure-network-firewall-policy | Microsoft.Network/firewallPolicies/read |
| Azure Virtual Network | azure-bastion-host | Microsoft.Network/bastionHosts/read |
| Azure Virtual Network | azure-bastion-diagnostic-settings | Microsoft.Network/bastionHosts/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Virtual Network | azure-private-link-service | Microsoft.Network/privateLinkServices/read |
| Azure Virtual Network | azure-network-natgateway | Microsoft.Network/natGateways/read |
| Azure Virtual Network | azure-vmss-instance-public-ips | Microsoft.Compute/virtualMachineScaleSets/read
Microsoft.Compute/virtualMachineScaleSets/publicIPAddresses/read
|
| Azure Virtual Network | azure-vmss-network-interface | Microsoft.Compute/virtualMachineScaleSets/read
Microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read
|
| Azure Virtual Network | azure-network-effective-nsg | Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action |
| Azure Virtual Network | azure-network-effective-route-table | Microsoft.Network/networkInterfaces/effectiveRouteTable/action |
| Azure Virtual Network | azure-network-public-ip-prefixes | Microsoft.Network/publicIPPrefixes/read |
| Azure Virtual Network | azure-network-service-endpoint-policy | Microsoft.Network/serviceEndpointPolicies/read
Microsoft.Network/serviceEndpointPolicies/serviceEndpointPolicyDefinitions/read
|
| Azure Virtual Network | azure-network-private-endpoint | Microsoft.Network/privateEndpoints/read |
| Azure Virtual Network | azure-network-private-dns-zone-groups | Microsoft.Network/privateEndpoints/read
Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read
|
| Azure Virtual Network Gateway | azure-virtual-network-gateway | Microsoft.Network/virtualNetworkGateways/read |
| Azure Virtual WAN | azure-virtual-wan-list | Microsoft.Network/virtualWans/read |
| Azure Virtual WAN | azure-vpn-server-configurations | Microsoft.Network/vpnServerConfigurations/read |
| Azure Virtual WAN | azure-p2s-vpn-gateway | Microsoft.Network/p2sVpnGateways/read |
| Azure Virtual WAN | azure-virtual-wan-virtual-hubs | Microsoft.Network/virtualHubs/read |
| Azure Visual Studio | azure-visual-studio-accounts | Microsoft.VisualStudio/account/read |
| Azure VPN Gateway | azure-network-vpn-connection-list | Microsoft.Network/virtualNetworkGateways/read
Microsoft.network/virtualnetworkgateways/connections/read
Microsoft.Network/virtualwans/vpnconfiguration/action
|
| Azure Web Application Firewall | azure-frontdoor-waf-policy | Microsoft.Network/frontDoorWebApplicationFirewallPolicies/read |
| Azure Web Application Firewall | azure-application-gateway-waf-policy | Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/read |
| Azure Web PubSub Service | azure-signalrservice-web-pub-sub | Microsoft.SignalRService/WebPubSub/read |
| Azure Web PubSub Service | azure-signalrservice-web-pub-sub-diagnostic-settings | Microsoft.SignalRService/WebPubSub/read
Microsoft.Insights/DiagnosticSettings/Read
|
| Azure Workloads | azure-workloads-monitors | Microsoft.Workloads/monitors/read |
## Agentless Scanning Resource Group Permissions
Azure Agentless Scanning permissions listed in the table below are scoped under the resource group `PCC_agentless_resource_group` instead of the Root Management group, for both Azure Tenant and Subscription onboarding. The tenant onboarding Terraform template creates `PCC_agentless_resource_group` under the subscriptions in the tenant, if not already present with the `prisma-agentless-scan tag`, and scopes these permissions under that resource group.
In addition, you can also add custom tags to the `PCC_agentless_resource_group`, by running the Terraform with `PCC_agentless_resource_group_tags` as shown below:
```
`terraform apply -var="PCC_agentless_resource_group_tags=key1=value1 key2=value2"`
```
| Feature | Permissions |
| ------------------ | ----------------------------------------------------- |
| Agentless Scanning | Agentless Workload Scanning |
| | Microsoft.Network/virtualNetworks/write |
| | Microsoft.Network/virtualNetworks/delete |
| | Microsoft.Compute/snapshots/write |
| | Microsoft.Compute/snapshots/delete |
| | Microsoft.Network/natGateways/write |
| | Microsoft.Network/natGateways/delete |
| | Microsoft.Network/networkInterfaces/write |
| | Microsoft.Network/networkInterfaces/delete |
| | Microsoft.Network/networkInterfaces/join/action |
| | Microsoft.Network/networkSecurityGroups/write |
| | Microsoft.Network/networkSecurityGroups/delete |
| | Microsoft.Network/networkSecurityGroups/join/action |
| | Microsoft.Network/publicIPAddresses/write |
| | Microsoft.Network/publicIPAddresses/delete |
| | Microsoft.Network/virtualNetworks/subnets/join/action |
| | Microsoft.Compute/disks/write |
| | Microsoft.Compute/disks/delete |
| | Microsoft.Compute/virtualMachines/write |
| | Microsoft.Compute/virtualMachines/delete |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/microsoft-azure-apis-ingested-by-prisma-cloud.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.