Azure: Inventory Permissions
This page outlines the permissions required for the Microsoft Azure inventory connector. Enable these permissions to view the resource listing in the inventory tab.
As cloud environments evolve and providers introduce API changes, required permissions may change as well. These permissions are reviewed and updated with each product release to reflect the latest requirements. Stale API entries are periodically removed, and updates are included in subsequent releases.
| Resource Type | Permissions |
|---|---|
| Application Gateway (application_gateways) | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/applicationGateways/read |
| LoadBalancer (load_balancer) | Microsoft.Network/loadBalancers/read |
| Cosmos Db (cosmos_db) | Microsoft.DocumentDB/databaseAccounts/read |
| Redis Cache (redis_cache) | Microsoft.Cache/redis/read |
| Disk (disk) | Microsoft.Compute/disks/read |
| Kubernetes Cluster (kubernetes_cluster) | Microsoft.ContainerService/managedClusters/read |
| Storage Account (storage_account) | Microsoft.Storage/storageAccounts/read |
| MySql Flexible Server (azure_mysql_flexible_server) | Microsoft.DBforMySQL/flexibleServers/read |
| PostgresSql Flexible Server (psql_server) | Microsoft.DBForPostgreSql/flexibleServers/read |
| AI Foundry (cognitive_service) | Microsoft.CognitiveServices/accounts/read Microsoft.CognitiveServices/accounts/deployments/read |
| Data Factory (data_factory) | Microsoft.DataFactory/factories/read |
| Virtual Wan (virtual_wan) | Microsoft.Network/virtualWans/read |
| Public IP Address (public_ip_addresses) | Microsoft.Network/publicIPAddresses/read |
| Network Interfaces (network_interfaces) | Microsoft.Network/networkInterfaces/read |
| Firewall (firewall) | Microsoft.Network/azureFirewalls/read |
| Nat Gateways (nat_gateways) | Microsoft.Network/natGateways/read |
| Network Security Groups | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/networkSecurityGroups/read |
| SQL Server | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Sql/servers/read |
| Virtual Machine |
Microsoft.Compute/virtualMachines/read Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/networkInterfaces/read Microsoft.Network/publicIPAddresses/read Microsoft.Network/networkSecurityGroups/read Microsoft.Compute/virtualMachines/instanceView/read |
| Virtual Network | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/virtualNetworks/read |
| Function App |
Microsoft.Web/sites/Read Microsoft.Web/sites/functions/read Microsoft.Web/sites/config/Read Microsoft.Web/sites/slots/Read |
| Web App |
Microsoft.Web/sites/slots/Read Microsoft.Web/sites/Read Microsoft.Web/sites/config/Read |
| SQL Database |
Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Sql/servers/databases/read Microsoft.Sql/servers/read |
| Analysis Services | Microsoft.AnalysisServices/servers/read |
| Automation Accounts | Microsoft.Automation/automationAccounts/read |
| IoT HUB | Microsoft.Devices/iotHubs/Read |
| Log Analytics workspace | Microsoft.OperationalInsights/workspaces/read |
| Synapse Workspace | Microsoft.Synapse/workspaces/read |
| Service Fabric Clusters | Microsoft.ServiceFabric/clusters/read |
| Web Application Firewall Policies |
Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/read |
| Data Factory Integration Runtimes |
Microsoft.DataFactory/factories/read Microsoft.DataFactory/factories/integrationruntimes/read |
| Monitor | Microsoft.Insights/LogProfiles/Read |
| AI Search | Microsoft.Search/searchServices/read |
| API Management Services | Microsoft.ApiManagement/service/read |
| Application Insights | Microsoft.Insights/Components/Read |
| Azure Data Explorer Clusters | Microsoft.Kusto/clusters/read |
| Azure IoT Hub Device Provisioning Services | Microsoft.Devices/provisioningServices/Read |
| Azure Spring Cloud App |
Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.AppPlatform/Spring/read Microsoft.AppPlatform/Spring/apps/read |
| Batch Accounts | Microsoft.Batch/batchAccounts/read |
| Batch Pools | Microsoft.Batch/batchAccounts/read Microsoft.Batch/batchAccounts/pools/read |
| Container Registries | Microsoft.ContainerRegistry/registries/read |
| Disk Accesses | Microsoft.Compute/diskAccesses/read |
| Event Grid Domains | Microsoft.EventGrid/domains/read |
| Event Grid Partner Namespaces | Microsoft.EventGrid/partnerNamespaces/read |
| Event Grid Topics | Microsoft.EventGrid/topics/read |
| Event Hubs Namespace | Microsoft.EventHub/namespaces/read |
| FHIR Service |
Microsoft.EventGrid/partnerNamespaces/read Microsoft.HealthcareApis/workspaces/read Microsoft.HealthcareApis/workspaces/fhirservices/read |
| Flow Logs | Microsoft.Network/networkWatchers/read Microsoft.Network/networkWatchers/flowLogs/read |
| Front Door WAF | Microsoft.Network/networkWatchers/read Microsoft.Network/networkWatchers/flowLogs/read |
| Images | Microsoft.Compute/images/read |
| Key Vaults |
Microsoft.KeyVault/vaults/read Microsoft.Resources/subscriptions/resources/read Microsoft.KeyVault/vaults/secrets/read |
| Service Bus Namespace |
Microsoft.ServiceBus/namespaces/authorizationRules/read Microsoft.ServiceBus/namespaces/read |
| Event Hubs |
Microsoft.EventHub/namespaces/read Microsoft.EventHub/namespaces/eventhubs/read Microsoft.EventHub/namespaces/eventhubs/authorizationRules/read |
| Snapshots | Microsoft.Compute/snapshots/read Microsoft.Resources/subscriptions/resourceGroups/read |
| Storage Sync Service | Microsoft.StorageSync/storageSyncServices/read |
| Resource Group | Microsoft.Resources/subscriptions/resourceGroups/read |
| Virtual Machine Scale Set | Microsoft.Compute/virtualMachineScaleSets/read |
| Virtual Machine Scale Set Instances | Microsoft.Compute/virtualMachineScaleSets/read |
| Entra ID User | User.Read.All |
| Entra ID Group | Group.Read.All |
| Entra ID App Registration | Application.Read.All |
| Entra ID Service Principal | Application.Read.All |
| Role Definitions | No Permission required |
| Managed Identities |
Microsoft.Authorization/denyAssignments/read Microsoft.ManagedIdentity/userAssignedIdentities/read |
| Role Assignment |
Microsoft.Authorization/denyAssignments/read Microsoft.ManagedIdentity/userAssignedIdentities/read Microsoft.Authorization/roleAssignments/read |
| Deny Assignment | Microsoft.Authorization/denyAssignments/read |
| Azure Databricks Workspace | Microsoft.Databricks/workspaces/read |
| App Service Environment | Microsoft.Web/hostingEnvironments/read |
| Machine Learning | Microsoft.MachineLearningServices/workspaces/read |
| Route Tables | Microsoft.Network/routeTables/read |
| Virtual Network Peering | Microsoft.Network/virtualNetworks/read |
| Workspaces | Microsoft.DesktopVirtualization/workspaces/read |
| SQL Managed Instance | Microsoft.Sql/managedInstances/read |
| Virtual Network Subnet |
Microsoft.Network/virtualNetworks/read Microsoft.Network/virtualNetworks/subnets/read |
| Web App Deployment Slots | Microsoft.Web/sites/Read Microsoft.Web/sites/slots/Read |
| Function App Deployment Slots | Microsoft.Web/sites/Read Microsoft.Web/sites/slots/Read |
| API App Deployment Slots | Microsoft.Web/sites/Read Microsoft.Web/sites/slots/Read |
| Logic App Deployment Slots | Microsoft.Web/sites/Read Microsoft.Web/sites/slots/Read |
| API App | Microsoft.Web/sites/Read |
| Logic Apps | Microsoft.Web/sites/Read |
| API Management Service API | Microsoft.ApiManagement/service/read |