> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/data-security-posture-management/prisma-cloud-dspm-deployment/deploy-prisma-cloud-dspm-on-azure/azure-permissions.md). # Azure Required Permissions Below is a list of the roles Prisma Cloud DSPM uses to access your Azure environment and the permissions they have. Permissions are used to access different types of data, or perform actions such as creating/deleting virtual machines (VMs), exporting snapshots, etc. **IMPORTANT:** If your Azure subscription has any firewall or network restrictions in place, it is imperative to grant access to the following: **Egress Traffic** In order to allow normal communication between Scanner VMs and the Prisma Cloud DSPM components, as well as various CSP services, make sure the following traffic is permitted: * Outbound rule: * **Type**: *HTTPS (Port 443)* * **Destination**: *0.0.0.0/0* **Ingress Traffic** Allow incoming traffic from the following Prisma Cloud DSPM's IP addresses to the customer’s cloud environment. This allows for API communication between Prisma Cloud DSPM’s SaaS environments to the customer’s cloud environment: * EU: * 52.48.123.3 * 99.80.210.235 * 34.247.249.123 * US: * 54.225.205.121 * 18.214.146.232 * 3.93.120.3 ## Which roles are deployed in Azure? ### Orchestrator Subscription: **subscription-scanner** - subscription scope, assigned to Managed identity **subscription-orchestrator** - subscription scope, assigned to Enterprise App **subscription-reader** - subscription scope, assigned to Enterprise App **orchestrator-role** - resource-group scope, assigned to Enterprise Application **scanner-role** - resource-group scope, assigned to Managed identity ### Monitored Subscriptions: **subscription-scanner** - subscription scope, assigned to Managed identity **subscription-orchestrator** - subscription scope, assigned to Enterprise App **subscription-reader** - subscription scope, assigned to Enterprise App **monitored-role** - resource-group scope, assigned to Enterprise Application **Tenant level** * **Enterprise application** with **applications.read** and **user.read** permissions * There is also an additional role (Dig-onboarding-monitoring-role) at the management group level when onboarding in a management group scope, with the following details: ## Dig-Onboarding-Monitoring-Role This role is assigned to the **Enterprise Application** and scoped to the **entire monitored management group.** **Permission** **Scope** **Purpose** Microsoft.Management/managementGroups/read The monitored management group Used for monitoring onboarded and new management groups Microsoft.Management/managementGroups/subscriptions/read The monitored management group Used for monitoring onboarded and new subscriptions Prisma Cloud DSPM Roles and permissions ## Dig-Security-Subscription-Reader-Role Used as a read-only access to your environment, this role enables Prisma Cloud DSPM to: * Access your assets’ metadata such as size, name and region * Collect activity logs for DDR capabilities This role is installed on **every** subscription monitored by Prisma Cloud DSPM, allowing us to discover and protect your assets. Prisma Cloud DSPM’s own environment performs the read-only API calls using the enterprise application. This role is assigned to the **Enterprise Application** and scoped to the **entire monitored subscription.** **Permissions** **Permission** **Scope** **Purpose** \*/read Monitored subscription Read-only access, used to get metadata of all managed data assets in the subscription Microsoft.CognitiveServices/\*/read Monitored subscription Discovery of OpenAI resources and other Azure AI services Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read Monitored subscription Reading metadata from blobs Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action Monitored subscription Getting SAS token of blobServices to enable access Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read Monitored subscription Reading metadata from file shares Microsoft.Storage/storageAccounts/tableServices/tables/entities/read Monitored subscription Reading metadata from tables Microsoft.Web/sites/config/list/action Monitored subscription Discovery and Risk assessment of Azure Web App ## Dig-Security-Scanner-Role This role is assigned to Prisma Cloud DSPM’s resource groups in the orchestrator subscriptions in your environment. It can be used only by a local managed identity in your subscription. This enables Prisma Cloud DSPM to detect and scan data for analysis and classification. All sensitive data that is detected, scanned and classified by Prisma Cloud DSPM’s resources never leaves the client's environment. This role is assigned to the **Managed Identity** and scoped to the **Prisma Cloud DSPM’s Resource Group in the Orchestrator subscription.** **Permissions** **Permission** **Scope** **Purpose** Microsoft.Insights/alertRules/\* Prisma Cloud DSPM’s resource group Getting metrics on Prisma Cloud DSPM resources Microsoft.Insights/diagnosticSettings/\* Prisma Cloud DSPM’s resource group Getting metrics on Prisma Cloud DSPM resources Microsoft.Network/privateDnsZones/join/action Prisma Cloud DSPM’s resource group Assigning private endpoint to DNS zones Microsoft.Network/privateEndpoints/delete Prisma Cloud DSPM’s resource group Deleting private endpoints Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write Prisma Cloud DSPM’s resource group Creating private DNS zones Microsoft.Network/privateEndpoints/write Prisma Cloud DSPM’s resource group Creating private endpoints Microsoft.Network/virtualNetworks/subnets/join/action Prisma Cloud DSPM’s resource group Assigning a private endpoint to a virtual network Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action Prisma Cloud DSPM’s resource group Assigning a private endpoint to a virtual network Microsoft.Resources/deployments/\* Prisma Cloud DSPM’s resource group Monitoring deployments Microsoft.Storage/storageAccounts/\* Prisma Cloud DSPM’s resource group Creating audit storage accounts Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action Prisma Cloud DSPM’s resource group Editing logs and reports in the audit storage account Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete Prisma Cloud DSPM’s resource group Deleting blobs in the audit storage account Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action Prisma Cloud DSPM’s resource group Editing logs and reports in the audit storage account Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read Prisma Cloud DSPM’s resource group Reading blobs in the audit storage account Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write Prisma Cloud DSPM’s resource group Writing logs and reports in the audit storage account Microsoft.Storage/storageAccounts/blobServices/containers/delete Prisma Cloud DSPM’s resource group Deleting old blobs in the audit storage account Microsoft.Storage/storageAccounts/blobServices/containers/write Prisma Cloud DSPM’s resource group Creating new containers in the audit storage account Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action Prisma Cloud DSPM’s resource group Getting access SAS token to the storage account Microsoft.documentdb/databaseaccounts/PrivateEndpointConnectionsApproval/action Monitored subscription Used for setting up a private endpoint on Cosmos DBs. This step is crucial for CosmosDB scanning ## Dig-Security-Subscription-Scanner-Role This role is installed on all the scanned (monitored) subscriptions in your environment. It can be used only by a local managed identity in your subscription. This enables Prisma Cloud DSPM to detect and scan data for analysis and classification. All sensitive data that is detected, scanned and classified by Prisma Cloud DSPM’s resources never leaves the client's environment. This role is assigned to the **Managed Identity** and scoped to the **entire monitored subscription**. **Permissions** **Permission** **Scope** **Purpose** \*/read Monitored subscription Read-only access, used to get metadata of all managed data assets in the subscription Microsoft.CognitiveServices/\*/action Monitored subscription Reading and scanning OpenAI files and other Azure AI data resources Microsoft.CognitiveServices/\*/read Monitored subscription Monitoring AI deployments Microsoft.DocumentDB/databaseAccounts/listKeys/\* Monitored subscription Getting SAS token of CosmosDB to enable access Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read Monitored subscription Assigning a private endpoint to a virtual network Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action Monitored subscription Getting SAS token of blobServices to enable access Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read Monitored subscription Scanning file shares Microsoft.Storage/storageAccounts/ListAccountSas/action Monitored subscription Getting access SAS token to the storage account to scan file share instances using API Microsoft.Storage/storageAccounts/listKeys/action Monitored subscription Getting access key to the storage account to scan file share instances using API Microsoft.Storage/storageAccounts/PrivateEndpointConnectionsApproval/action Monitored subscription Enabling a scan by assigning private endpoints to a storage account located in a private network Microsoft.Storage/storageAccounts/tableServices/tables/entities/read Monitored subscription Scanning tables ## Dig-Security-Subscription-Orchestrator-Role These permissions are installed on all monitored subscriptions in your environment. This role enables Prisma Cloud DSPM to classify and scan data assets and analyze them in Prisma Cloud DSPM’s resource group. All sensitive data that is detected, scanned and classified by Prisma Cloud DSPM’s resources never leaves the client's environment. This role is assigned to the **Enterprise Application** and scoped to the **entire monitored subscription.** **Permissions** **Permission** **Scope** **Purpose** Microsoft.documentdb/databaseaccounts/PrivateEndpointConnectionsApproval/action Monitored subscription Used for setting up a private endpoint on Cosmos DBs. This step is crucial for CosmosDB scanning Microsoft.Sql/managedInstances/databases/readBackups/action Monitored subscription Used for copying SQL managed instances to Prisma Cloud DSPM’s resource group, enabling Prisma Cloud DSPM to connect and scan it Microsoft.Sql/managedInstances/databases/write Monitored subscription Used for copying PITR of SQL managed instances to Prisma Cloud DSPM’s resource group, enabling Prisma Cloud DSPM to restore and scan it Microsoft.Sql/servers/databases/write Monitored subscription Used for copying SQL databases to Prisma Cloud DSPM’s resource group, enabling Prisma Cloud DSPM to connect and scan it ## Dig-Security-Monitored-Role These permissions are installed on all Prisma Cloud DSPM’s resource groups in all monitored subscriptions except the orchestrator.\ This role is used for creating temporary resources inside Prisma Cloud DSPM’s resource group only. This role is assigned to the **Enterprise Application** and scoped to the **Prisma Cloud DSPM’s Resource Group in the Monitored subscription.** ### Permission **Permission** **Scope** **Purpose** Microsoft.Compute/disks/beginGetAccess/action Prisma Cloud DSPM’s resource group Enabling access to the disk data for creating disks from snapshots Microsoft.Compute/disks/delete Prisma Cloud DSPM’s resource group Deleting created disks Microsoft.Compute/disks/write Prisma Cloud DSPM’s resource group Creating and modifying snapshots of the scanned disks Microsoft.Compute/snapshots/delete Prisma Cloud DSPM’s resource group Deleting scanned snapshots Microsoft.Compute/snapshots/write Prisma Cloud DSPM’s resource group Creating and modifying snapshots for scanning Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Prisma Cloud DSPM’s resource group only Assigning a managed identity to the created VM Microsoft.Network/natGateways/join/action Prisma Cloud DSPM’s resource group Associating NAT gateways with the created VMs Microsoft.Network/natGateways/write Prisma Cloud DSPM’s resource group Creating and modifying NAT gateways Microsoft.Network/networkInterfaces/delete Prisma Cloud DSPM’s resource group Deleting created network interfaces Microsoft.Network/networkInterfaces/join/action Prisma Cloud DSPM’s resource group Associating the created network interface with a virtual machine Microsoft.Network/networkInterfaces/write Prisma Cloud DSPM’s resource group Creating and modifying network interfaces to ensure that the created VMs have outbound internet access Microsoft.Network/networkSecurityGroups/delete Prisma Cloud DSPM’s resource group Deleting created security groups Microsoft.Network/networkSecurityGroups/join/action Prisma Cloud DSPM’s resource group Associating the created security group with a subnet or network interface Microsoft.Network/networkSecurityGroups/write Prisma Cloud DSPM’s resource group Creating and modifying security groups to ensure that Prisma Cloud DSPM’s VMs cannot be reached and secured Microsoft.Network/privateDnsZones/delete Prisma Cloud DSPM’s resource group Setting private DNS zones to classify private resource Microsoft.Network/privateDnsZones/join/action Prisma Cloud DSPM’s resource group Setting private DNS zones to classify private resource Microsoft.Network/privateDnsZones/virtualNetworkLinks/write Prisma Cloud DSPM’s resource group Setting private DNS zones to classify private resource Microsoft.Network/privateDnsZones/write Prisma Cloud DSPM’s resource group Setting private DNS zones to classify private resource Microsoft.Network/privateEndpoints/delete Prisma Cloud DSPM’s resource group Deleting unused private endpoints Microsoft.Network/privateEndpoints/privateDnsZoneGroups/delete Prisma Cloud DSPM’s resource group Setting private endpoints to classify private resource Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write Prisma Cloud DSPM’s resource group Setting private endpoints to classify private resource Microsoft.Network/privateEndpoints/write Prisma Cloud DSPM’s resource group Setting private endpoints to classify private resource Microsoft.Network/routeTables/\* Prisma Cloud DSPM’s resource group Routing internal traffic Microsoft.Network/virtualNetworks/delete Prisma Cloud DSPM’s resource group Deleting created virtual networks Microsoft.Network/virtualNetworks/join/action Prisma Cloud DSPM’s resource group Connect subnet to the Prisma Cloud Resources Microsoft.Network/virtualNetworks/subnets/delete Prisma Cloud DSPM’s resource group Connect subnet to the Prisma Cloud Resources Microsoft.Network/virtualNetworks/subnets/join/action Prisma Cloud DSPM’s resource group Associating virtual networks with the created VMs Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action Prisma Cloud DSPM’s resource group Assigning a private endpoint to a virtual network Microsoft.Network/virtualNetworks/subnets/write Prisma Cloud DSPM’s resource group only Creating and modifying subnets inside the virtual network Microsoft.Network/virtualNetworks/write Prisma Cloud DSPM’s resource group Creating and modifying a virtual network so that the created virtual machines Microsoft.Resources/deployments/write Prisma Cloud DSPM’s resource group Deploying resources to a resource group Microsoft.Sql/locations/\*/read Prisma Cloud DSPM’s resource group Used for classification of managed instances Microsoft.Sql/managedInstances/\* Prisma Cloud DSPM’s resource group Used for classification of managed instances Microsoft.Sql/servers/databases/delete Prisma Cloud DSPM’s resource group Cleaning stale assets such as Prisma Cloud DSPM’s Azure SQL databases - only in the Orchestrator resource group Microsoft.Sql/servers/databases/move/action Prisma Cloud DSPM’s resource group Creating and managing Prisma Cloud DSPM’s Azure SQL databases in the Orchestrator resource group Microsoft.Sql/servers/databases/read Prisma Cloud DSPM’s resource group Getting configurations on Prisma Cloud DSPM’s Azure SQL databases - only in the Orchestrator resource group Microsoft.Sql/servers/databases/write Prisma Cloud DSPM’s resource group Copying and managing SQL databases in Prisma Cloud DSPM’s Azure SQL server in the Orchestrator resource group Microsoft.Sql/servers/delete Prisma Cloud DSPM’s resource group Cleaning stale assets such as Prisma Cloud DSPM’s Azure SQL server - only in the Orchestrator resource group Microsoft.Sql/servers/encryptionProtector/\* Prisma Cloud DSPM’s resource group Required in order to classify SQL servers encrypted with server-level TDE Microsoft.Sql/servers/privateEndpointConnectionsApproval/action Prisma Cloud DSPM’s resource group Enables connection using endpoints Microsoft.Sql/servers/read Prisma Cloud DSPM’s resource group Getting configurations on Prisma Cloud DSPM’s Azure SQL server - only in the Orchestrator resource group Microsoft.Sql/servers/virtualNetworkRules/\* Prisma Cloud DSPM’s resource group Configuring network accessibility from the scanning VMs on Prisma Cloud DSPM’s Azure SQL server - only in the Orchestrator resource group Microsoft.Sql/servers/write Prisma Cloud DSPM’s resource group Creating and managing Prisma Cloud DSPM’s Azure SQL server in the orchestrator resource group ## Dig-Security-Orchestrator-Role These permissions are installed on Prisma Cloud DSPM’s resource-group within the orchestrator subscription.\ This role is used for deploying Prisma Cloud DSPM’s compute resources (VMs) that scan and analyze the monitored subscription. Each VM is assigned with scanner permissions so that it can access, scan and analyze the data. All sensitive data that is detected, scanned and classified by Prisma Cloud DSPM’s resources never leaves the client's environment. This role is assigned to the **Enterprise Application** and scoped to the **Prisma Cloud DSPM’s Resource Group in the Orchestrator subscription.** **Permissions** **Permission** **Scope** **Purpose** Microsoft.Compute/disks/beginGetAccess/action Prisma Cloud DSPM’s resource group Enabling access to the disk data for creating disks from snapshots Microsoft.Compute/disks/delete Prisma Cloud DSPM’s resource group Deleting created disks Microsoft.Compute/disks/write Prisma Cloud DSPM’s resource group Creating and modifying snapshots of the scanned disks Microsoft.Compute/snapshots/delete Prisma Cloud DSPM’s resource group Deleting scanned snapshots Microsoft.Compute/snapshots/write Prisma Cloud DSPM’s resource group Creating and modifying snapshots for scanning Microsoft.Compute/virtualMachines/delete Prisma Cloud DSPM’s resource group Deleting scanner virtual machines (VMs) Microsoft.Compute/virtualMachines/write Prisma Cloud DSPM’s resource group Creating and modifying VMs and attaching disks Microsoft.EventHub/\* Prisma Cloud DSPM’s resource group Permissions to manage Prisma Cloud DSPM’s Event Hub for DDR capabilities Microsoft.EventHub/\*/receive/action Monitored subscription Reading activity logs from Dig-Security event hub Microsoft.KeyVault/vaults/write Prisma Cloud DSPM’s resource group Create Vault for saving secrets as part of scanning services that requires password creation Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Prisma Cloud DSPM’s resource group only Assigning a managed identity to the created VM Microsoft.Network/natGateways/delete Prisma Cloud DSPM’s resource group Deleting NAT gateways Microsoft.Network/natGateways/join/action Prisma Cloud DSPM’s resource group Associating NAT gateways with the created VMs Microsoft.Network/natGateways/write Prisma Cloud DSPM’s resource group Creating and modifying NAT gateways Microsoft.Network/networkInterfaces/delete Prisma Cloud DSPM’s resource group Deleting created network interfaces Microsoft.Network/networkInterfaces/join/action Prisma Cloud DSPM’s resource group Associating the created network interface with a virtual machine Microsoft.Network/networkInterfaces/write Prisma Cloud DSPM’s resource group Creating and modifying network interfaces to ensure that the created VMs have outbound internet access Microsoft.Network/networkSecurityGroups/delete Prisma Cloud DSPM’s resource group Deleting created security groups Microsoft.Network/networkSecurityGroups/join/action Prisma Cloud DSPM’s resource group Associating the created security group with a subnet or network interface Microsoft.Network/networkSecurityGroups/securityRules/write Prisma Cloud DSPM’s resource group Modifying the Network Security Group (NSG) to establish an outgoing connection over SMB (port 445) with on-prem file shares for classification purposes Microsoft.Network/networkSecurityGroups/write Prisma Cloud DSPM’s resource group Creating and modifying security groups to ensure that Prisma Cloud DSPM’s VMs cannot be reached and secured Microsoft.Network/privateDnsZones/A/write Prisma Cloud DSPM’s resource group Permissions to add privateDNS zone as part of the SQL Managed Instance scanning Microsoft.Network/privateDnsZones/delete Prisma Cloud DSPM’s resource group Setting private DNS zones to classify private resource Microsoft.Network/privateDnsZones/join/actionMicrosoft.Storage/storageAccounts/blobServices/containers/blobs/read Prisma Cloud DSPM’s resource group Setting private DNS zones to classify private resource Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete Prisma Cloud DSPM’s resource group Setting private DNS zones to classify private resource Microsoft.Network/privateDnsZones/virtualNetworkLinks/write Prisma Cloud DSPM’s resource group Setting private DNS zones to classify private resource Microsoft.Network/privateDnsZones/write Prisma Cloud DSPM’s resource group Setting private DNS zones to classify private resource Microsoft.Network/privateEndpoints/privateDnsZoneGroups/delete Prisma Cloud DSPM’s resource group Setting private endpoints to classify private resource Microsoft.Network/privateEndpoints/privateDnsZoneGroups/write Prisma Cloud DSPM’s resource group Setting private endpoints to classify private resource Microsoft.Network/privateEndpoints/write Prisma Cloud DSPM’s resource group Setting private endpoints to classify private resource Microsoft.Network/publicIPAddresses/delete Prisma Cloud DSPM’s resource group only Deleting the public IP address Microsoft.Network/publicIPAddresses/join/action Prisma Cloud DSPM’s resource group only Associating the created public IP Microsoft.Network/publicIPAddresses/write Prisma Cloud DSPM’s resource group only Creating and modifying the public IP address Microsoft.Network/virtualNetworks/delete Prisma Cloud DSPM’s resource group Deleting created virtual networks Microsoft.Network/virtualNetworks/join/action Prisma Cloud DSPM’s resource group Connect subnet to the Prisma Cloud Resources Microsoft.Network/virtualNetworks/subnets/delete Prisma Cloud DSPM’s resource group Assigning a private endpoint to a virtual network Microsoft.Network/virtualNetworks/subnets/join/action Prisma Cloud DSPM’s resource group Associating virtual networks with the created VMs Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action Prisma Cloud DSPM’s resource group Assigning a private endpoint to a virtual network Microsoft.Network/virtualNetworks/subnets/write Prisma Cloud DSPM’s resource group only Creating and modifying subnets inside the virtual network Microsoft.Network/virtualNetworks/write Prisma Cloud DSPM’s resource group Creating and modifying a virtual network so that the created virtual machines Microsoft.Resources/deployments/write Prisma Cloud DSPM’s resource group Deploying resources to a resource group Microsoft.Sql/servers/administrators/delete Prisma Cloud DSPM’s resource group Used for classification of SQL Server Microsoft.Sql/servers/administrators/read Prisma Cloud DSPM’s resource group Used for classification of SQL Server Microsoft.Sql/servers/administrators/write Prisma Cloud DSPM’s resource group Used for classification of SQL Server Microsoft.Sql/servers/databases/\* Prisma Cloud DSPM’s resource group Creating and managing Prisma Cloud DSPM’s Azure SQL databases in the Orchestrator resource group Microsoft.Sql/servers/delete Prisma Cloud DSPM’s resource group Cleaning stale assets such as Prisma Cloud DSPM’s Azure SQL server - only in the Orchestrator resource group Microsoft.Sql/servers/encryptionProtector/\* Prisma Cloud DSPM’s resource group Required in order to classify SQL servers encrypted with server-level TDE Microsoft.Sql/servers/read Prisma Cloud DSPM’s resource group Getting configurations on Prisma Cloud DSPM’s Azure SQL server - only in the Orchestrator resource group Microsoft.Sql/servers/virtualNetworkRules/\* Prisma Cloud DSPM’s resource group Configuring network accessibility from the scanning VMs on Prisma Cloud DSPM’s Azure SQL server - only in the Orchestrator resource group Microsoft.Sql/servers/write Prisma Cloud DSPM’s resource group Creating and managing Prisma Cloud DSPM’s Azure SQL server in the orchestrator resource group Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete Prisma Cloud DSPM’s resource group Deleting blobs in the audit storage account Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write Prisma Cloud DSPM’s resource group Writing logs and reports in the audit storage account Microsoft.Storage/storageAccounts/blobServices/containers/delete Prisma Cloud DSPM’s resource group Deleting old blobs in the audit storage account Microsoft.Storage/storageAccounts/blobServices/containers/write Prisma Cloud DSPM’s resource group Creating new containers in the audit storage account Microsoft.Storage/storageAccounts/blobServices/write Prisma Cloud DSPM’s resource group Writing data into the audit storage account Microsoft.Storage/storageAccounts/delete Prisma Cloud DSPM’s resource group Deleting an audit storage account Microsoft.Storage/storageAccounts/managementPolicies/delete Prisma Cloud DSPM’s resource group Permissions for deleting a lifecycle policy on Prisma Cloud DSPM’s storage accounts Microsoft.Storage/storageAccounts/managementPolicies/write Prisma Cloud DSPM’s resource group Permissions for adding a lifecycle policy on Prisma Cloud DSPM’s storage accounts Microsoft.Storage/storageAccounts/write Prisma Cloud DSPM’s resource group Creating an audit storage account **Note:** For additional details about the architecture of Prisma Cloud DSPM, please consult with your account team. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/data-security-posture-management/prisma-cloud-dspm-deployment/deploy-prisma-cloud-dspm-on-azure/azure-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.