> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/update-azure-application-permissions.md).

# Update Azure Application Permissions

Even after you have completed onboarding, you have the option to add or remove Prisma Cloud Security Capabilities. Learn how you can add additional capabilities and the required associated permissions in your Azure subscriptions or tenants after onboarding. To verify if you have missing permissions authenticate into Prisma Cloud and select **Settings > Cloud Accounts**, and view the **Status** column.

## Update Azure Custom Role Permissions

Before you add new new Security Capabilities, you must first update the permissions granted to the existing custom role created during the onboarding process. This workflow is only available for Azure Tenant and Subscription onboarding. Additionally, Azure China does not support the use of Terraform templates.

### Using Terraform Script (Recommended)

Follow the steps below to update your custom role permissions and add or modify existing Prisma Cloud Security Capabilities.

1. Authenticate using Azure CLI.
2. Navigate to the directory you created during the onboarding process to store the Terraform file. Sample directory names include *onboard-tenant-\<tenant-name>* or *onboard–subscription-\<subscription-name>*. Ensure that the directory contains the *terraform.tfstate file* created during the **terraform apply** step.
3. Select the required features under **Security Capabilities and Permissions** section in the **Get Started** dialog.
4. Download the Terraform again by clicking on **Edit Cloud Account > Configure Account > Download Terraform Script** button. The newly downloaded Terraform file contains the updated permissions.
5. Run the command **terraform init > terraform apply** and click **Confirm**.
6. The existing custom role is now updated with new permissions, once the Terraform execution is completed.

   If the *terraform.tfstate* file is not present in the directory, when the Terraform script is executed, a new app is registered and a new custom role is created.

### Manually update Custom Roles

If your organization restricts the use of Terraform scripts, you can choose to manually add the new permissions to the existing custom roles.

1. Authenticate into Azure portal.
2. For Tenant onboarding: Navigate to **All Services > Management Groups**. Click on Tenant Root Group For Subscription onboarding: Navigate to **All Services > Subscriptions**.
3. Select Access Control (IAM) > Roles.
4. Search for the custom role created during onboarding in the **Search** box and click on the **Edit** button.
5. Update the custom role page, click on JSON. You can view your existing custom role JSON with the permissions under the actions list.
6. Click on the **Edit** button, append the comma separated new permissions in the actions list. Click on **Save > Review + update**.
7. Verify your **Role name and Permissions**. Click on **Update**. Wait for few minutes for the custom role to update.

### Add Microsoft Graph API Permissions

Follow the steps below to assign graph API permissions at the tenant level.

1. Add the required permissions.
   1. Navigate to the app you previously registered. Select **Azure > Active > Directory > App registrations**, and select your app.
   2. Navigate to Microsoft Graph. Select **API > permissions > Add a permission > Microsoft Graph > Application permissions**.
   3. Add the permissions. Enter the permission name in **Select permissions**, and select the name from **Permission**. Add the following permissions:
      * User.Read.All
      * Policy.Read.All
      * Group.Read.All
      * GroupMember.Read.All
      * Reports.Read.All
      * Directory.Read.All
      * Domain.Read.All
      * Application.Read.All

        If you have enabled additional functions like Agentless Scanning or Workload Protection additional permissions will be required. Review the **Roles and Permissions** list for the required permissions.
2. Grant admin consent for Default Directory.
   1. Select **Grant admin consent for Default Directory > Yes**.
   2. Verify that the permissions are granted.
   3. Confirm that you can see green check marks under the **Status** column.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-azure-account/update-azure-application-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.