ARM Template Installation - Required Permissions
Permissions below are required to install Protegrity service using ARM template.
All permissions in the table must be granted with the Resource group scope.
Permissions | Description | Built-In Azure Role |
|---|---|---|
| Read access to monitoring data and settings | Monitoring Reader |
| Write and manage access to monitoring data and settings | Monitoring Contributor |
| Write and manage access to web apps | Website Contributor |
| Manage and assign managed identities NoteThese permissions are only required when user assigned identity is used. | Managed Identity Operator |
| Manage and validate deployments | Deployment Contributor |
Log Forwarder service ARM deployment requires additional permissions below:
Permissions | Description | Built-In Azure Role |
|---|---|---|
| Allow for the creation, update, and deletion of Event Hub namespaces, event hubs within those namespaces, and their network rule sets, enabling full management of Event Hub resources. Note: These permissions are only required when deploying new event Hub. | Event Hubs Contributor |
| Read monitoring data and metrics, including Event Hub namespace data. | Monitoring Reader |
The additional permissions listed below are required when API management is part of the deployment.
Permissions | Description | Built-In Azure Role |
|---|---|---|
| Create or update API Management service instances, APIs, diagnostics, API operations, operation policies, backends, loggers, tenant policies, and API diagnostics. | API Management Service Contributor |
| Read metadata for API Management service instances and get the status of long-running operations. | API Management Service Reader |
Feedback
Was this page helpful?