Azure: Inventory Permissions
This page outlines the permissions required for the Microsoft Azure inventory connector. Enable these permissions to view the resource listing in the inventory tab.
As cloud environments evolve and providers introduce API changes, required permissions may change as well. These permissions are reviewed and updated with each product release to reflect the latest requirements. Stale API entries are periodically removed, and updates are included in subsequent releases.
| Resource Type | Permissions |
|---|---|
| Activity Log Alert | Microsoft.Insights/activityLogAlerts/read |
| AI Foundry (cognitive_service) | Microsoft.CognitiveServices/accounts/read Microsoft.CognitiveServices/accounts/deployments/read |
| AI Search | Microsoft.Search/searchServices/read |
| Analysis Services | Microsoft.AnalysisServices/servers/read |
| API App | Microsoft.Web/sites/Read |
| API App Deployment Slots | Microsoft.Web/sites/Read Microsoft.Web/sites/slots/Read |
| API Management APIs Workspace | Microsoft.ApiManagement/service/workspaces/read |
| API Management Service API | Microsoft.ApiManagement/service/read |
| API Management Services | Microsoft.ApiManagement/service/read |
| App Service Environment | Microsoft.Web/hostingEnvironments/read |
| Application Gateway (application_gateways) | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/applicationGateways/read |
| Application Insights | Microsoft.Insights/Components/Read |
| Automation Accounts | Microsoft.Automation/automationAccounts/read |
| Azure Data Explorer Clusters | Microsoft.Kusto/clusters/read |
| Azure Databricks Workspace | Microsoft.Databricks/workspaces/read |
| Azure IoT Hub Device Provisioning Services | Microsoft.Devices/provisioningServices/Read |
| Azure Policy Assignment | Microsoft.Authorization/policyAssignments/read |
| Azure SignalR Service | Microsoft.SignalRService/SignalR/read |
| Azure Spring Cloud App | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.AppPlatform/Spring/read Microsoft.AppPlatform/Spring/apps/read |
| Backup Vault (Azure Data Protection Backup Vaults) | Microsoft.DataProtection/backupVaults/backupPolicies/read |
| Backup Vault Policy (Azure Data Protection Backup Policies) | Microsoft.DataProtection/backupVaults/read |
| Bastion Host | Microsoft.Network/bastionHosts/read |
| Batch Accounts | Microsoft.Batch/batchAccounts/read |
| Batch Pools | Microsoft.Batch/batchAccounts/read Microsoft.Batch/batchAccounts/pools/read |
| CDN endpoint | Microsoft.Cdn/profiles/endpoints/read |
| CDN profile | Microsoft.Cdn/profiles/read |
| Container Registries | Microsoft.ContainerRegistry/registries/read |
| Cosmos Db (cosmos_db) | Microsoft.DocumentDB/databaseAccounts/read |
| Data Factory (data_factory) | Microsoft.DataFactory/factories/read |
| Data Factory Integration Runtimes | Microsoft.DataFactory/factories/read Microsoft.DataFactory/factories/integrationruntimes/read |
| Deny Assignment | Microsoft.Authorization/denyAssignments/read |
| Diagnostic Settings | Microsoft.Insights/diagnosticSettings/read |
| Disk (disk) | Microsoft.Compute/disks/read |
| Disk Accesses | Microsoft.Compute/diskAccesses/read |
| Entra ID App Registration | Application.Read.All |
| Entra ID Group | Group.Read.All |
| Entra ID Service Principal | Application.Read.All |
| Entra ID User | User.Read.All |
| Event Grid Domains | Microsoft.EventGrid/domains/read |
| Event Grid Partner Namespaces | Microsoft.EventGrid/partnerNamespaces/read |
| Event Grid Topics | Microsoft.EventGrid/topics/read |
| Event Hubs | Microsoft.EventHub/namespaces/read Microsoft.EventHub/namespaces/eventhubs/read Microsoft.EventHub/namespaces/eventhubs/authorizationRules/read |
| Event Hubs Namespace | Microsoft.EventHub/namespaces/read |
| FHIR Service | Microsoft.EventGrid/partnerNamespaces/read Microsoft.HealthcareApis/workspaces/read Microsoft.HealthcareApis/workspaces/fhirservices/read |
| Firewall (firewall) | Microsoft.Network/azureFirewalls/read |
| Flow Logs | Microsoft.Network/networkWatchers/read Microsoft.Network/networkWatchers/flowLogs/read |
| Front Door | Microsoft.Cdn/profiles/read |
| Front Door WAF | Microsoft.Network/networkWatchers/read Microsoft.Network/networkWatchers/flowLogs/read |
| Function App | Microsoft.Web/sites/Read Microsoft.Web/sites/functions/read Microsoft.Web/sites/config/Read Microsoft.Web/sites/slots/Read |
| Function App Deployment Slots | Microsoft.Web/sites/Read Microsoft.Web/sites/slots/Read |
| Images | Microsoft.Compute/images/read |
| IoT HUB | Microsoft.Devices/iotHubs/Read |
| Key Vault Managed Hsms | Microsoft.KeyVault/managedHSMs/read |
| Key Vaults | Microsoft.KeyVault/vaults/read Microsoft.Resources/subscriptions/resources/read Microsoft.KeyVault/vaults/secrets/read |
| Kubernetes Cluster (kubernetes_cluster) | Microsoft.ContainerService/managedClusters/read |
| LoadBalancer (load_balancer) | Microsoft.Network/loadBalancers/read |
| Log Analytics workspace | Microsoft.OperationalInsights/workspaces/read |
| Logic App Deployment Slots | Microsoft.Web/sites/Read Microsoft.Web/sites/slots/Read |
| Logic App Workflow | Microsoft.Logic/workflows/read |
| Logic Apps | Microsoft.Web/sites/Read |
| Machine Learning | Microsoft.MachineLearningServices/workspaces/read |
| Managed Identities | Microsoft.Authorization/denyAssignments/read Microsoft.ManagedIdentity/userAssignedIdentities/read |
| Monitor | Microsoft.Insights/LogProfiles/Read |
| MySql Flexible Server (azure_mysql_flexible_server) | Microsoft.DBforMySQL/flexibleServers/read |
| Nat Gateways (nat_gateways) | Microsoft.Network/natGateways/read |
| Network Interfaces (network_interfaces) | Microsoft.Network/networkInterfaces/read |
| Network Security Groups | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/networkSecurityGroups/read |
| PostgresSql Flexible Server (psql_server) | Microsoft.DBForPostgreSql/flexibleServers/read |
| Public IP Address (public_ip_addresses) | Microsoft.Network/publicIPAddresses/read |
| Recovery Service Vault | Microsoft.RecoveryServices/Vaults/read Microsoft.Insights/diagnosticSettings/read |
| Recovery Service Vault Backup Policy | Microsoft.RecoveryServices/Vaults/backupPolicies/read |
| Redis Cache (redis_cache) | Microsoft.Cache/redis/read |
| Resource Group | Microsoft.Resources/subscriptions/resourceGroups/read |
| Role Assignment | Microsoft.Authorization/denyAssignments/read Microsoft.ManagedIdentity/userAssignedIdentities/read Microsoft.Authorization/roleAssignments/read |
| Role Definitions | No Permission required |
| Route Tables | Microsoft.Network/routeTables/read |
| Security Center Settings | Microsoft.Security/pricings/read |
| Service Bus Namespace | Microsoft.ServiceBus/namespaces/authorizationRules/read Microsoft.ServiceBus/namespaces/read |
| Service Fabric Clusters | Microsoft.ServiceFabric/clusters/read |
| Snapshots | Microsoft.Compute/snapshots/read Microsoft.Resources/subscriptions/resourceGroups/read |
| SQL Database | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Sql/servers/databases/read Microsoft.Sql/servers/read |
| SQL Managed Instance | Microsoft.Sql/managedInstances/read |
| SQL Server | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Sql/servers/read |
| Storage Account (storage_account) | Microsoft.Storage/storageAccounts/read |
| Storage Sync Service | Microsoft.StorageSync/storageSyncServices/read |
| Streaming Jobs (Azure Stream Analytics Jobs) | Microsoft.StreamAnalytics/streamingjobs/read |
| Subscriptions | Microsoft.Resources/subscriptions/read |
| Synapse Workspace | Microsoft.Synapse/workspaces/read |
| Virtual Machine | Microsoft.Compute/virtualMachines/read Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/networkInterfaces/read Microsoft.Network/publicIPAddresses/read Microsoft.Network/networkSecurityGroups/read Microsoft.Compute/virtualMachines/instanceView/read |
| Virtual Machine Scale Set | Microsoft.Compute/virtualMachineScaleSets/read |
| Virtual Machine Scale Set Instances | Microsoft.Compute/virtualMachineScaleSets/read |
| Virtual Network | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/virtualNetworks/read |
| Virtual Network Peering | Microsoft.Network/virtualNetworks/read |
| Virtual Network Subnet | Microsoft.Network/virtualNetworks/read Microsoft.Network/virtualNetworks/subnets/read |
| Virtual Wan (virtual_wan) | Microsoft.Network/virtualWans/read |
| Web App | Microsoft.Web/sites/slots/Read Microsoft.Web/sites/Read Microsoft.Web/sites/config/Read |
| Web App Deployment Slots | Microsoft.Web/sites/Read Microsoft.Web/sites/slots/Read |
| Web Application Firewall Policies | Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/read |
| Web PubSub | Microsoft.SignalRService/WebPubSub/read |
| Workspaces | Microsoft.DesktopVirtualization/workspaces/read |