Azure Permissions Reference¶

AccuKnox's Azure scanner uses the AK Reader Aligned Role, 209 read-only permissions on Azure Resource Manager (ARM) resources. It reads configuration to detect misconfigurations, with no write or delete access.

See the overview to compare clouds, or the Azure prerequisites for setup steps.

Reading this reference

Permissions are grouped by service; ones that serve the same purpose share a row. Hover (or tap) the ⓘ badge to see why AccuKnox needs each one.

Advisor (1)¶

Permission	Details
`Microsoft.Advisor/recommendations/read`	Function: Reads Azure Advisor recommendations across cost, security, reliability, and performance Findings: High-impact Advisor recommendations, cost optimization opportunities, reliability gaps Impact

AlertsManagement (1)¶

Permission	Details
`Microsoft.AlertsManagement/alerts/read`	Function: Reads unified alerts management interface Findings: Alerts management not consolidated, missing smart groups Impact

ApiManagement (4)¶

Permission	Details
`Microsoft.ApiManagement/service/apis/read`	Function: Reads APIs published through API Management Findings: APIs without OAuth/OIDC, missing subscription key requirement, missing rate limiting Impact
`Microsoft.ApiManagement/service/backends/read`	Function: Reads backend service definitions in API Management Findings: Backend using HTTP instead of HTTPS, missing certificate validation Impact
`Microsoft.ApiManagement/service/products/read`	Function: Reads API Management product definitions Findings: Products with subscription required disabled, open products exposing sensitive APIs Impact
`Microsoft.ApiManagement/service/read`	Function: Enumerates API Management instances Findings: APIM with public access, missing VNet integration, using Consumption tier for critical APIs, weak SSL/TLS Impact

AppConfiguration (1)¶

Permission	Details
`Microsoft.AppConfiguration/configurationStores/read`	Function: Reads App Configuration store configurations Findings: App Config with public access, missing private endpoint, missing CMK, missing purge protection Impact

AppPlatform (1)¶

Permission	Details
`Microsoft.AppPlatform/Spring/read`	Function: Reads Azure Spring Cloud (Spring Apps) service configuration - apps, deployments, TLS settings, config servers [NOTE] RETIRED - Retained to support existing Spring Cloud customers. Findings: Public network access enabled, missing customer-managed encryption, missing diagnostic logging, weak TLS Impact

Authorization (4)¶

Permission	Details
`Microsoft.Authorization/denyAssignments/read`	Function: Reads deny assignments (explicit denials layered over role assignments) Findings: Missing deny assignments on production resources Impact
`Microsoft.Authorization/locks/read`	Function: Reads management locks on subscriptions, resource groups, and individual resources Findings: Resource groups without delete locks, critical resources without CanNotDelete locks, missing ReadOnly locks on shared resources Impact
`Microsoft.Authorization/roleAssignments/read`	Function: Reads Azure RBAC role assignments (who has what role, at what scope) Findings: Owner role assigned at subscription scope, guest users with elevated roles, service principals with Contributor at root, stale role assignments Impact
`Microsoft.Authorization/roleDefinitions/read`	Function: Reads Azure RBAC role definitions (built-in and custom roles) Findings: Custom roles with wildcard actions, custom roles duplicating built-in roles, unused custom roles Impact

Automation (3)¶

Permission	Details
`Microsoft.Automation/automationAccounts/read`	Function: Reads Azure Automation automation account Findings: Runbook with plaintext credentials, variable without encryption, automation account with public access, missing managed identity Impact
`Microsoft.Automation/automationAccounts/runbooks/read`	Function: Reads Azure Automation runbooks Findings: Runbook with plaintext credentials, variable without encryption, automation account with public access, missing managed identity Impact
`Microsoft.Automation/automationAccounts/variables/read`	Function: Reads Azure Automation variables Findings: Runbook with plaintext credentials, variable without encryption, automation account with public access, missing managed identity Impact

Batch (1)¶

Permission	Details
`Microsoft.Batch/batchAccounts/read`	Function: Enumerates Azure Batch accounts used for large-scale parallel workloads Findings: Batch with shared key auth, missing user subscription authentication, no CMK encryption, public network access Impact

Cache (5)¶

Permission Details

Microsoft.Cache/redis/firewallRules/read Microsoft.Cache/redis/linkedServers/read Microsoft.Cache/redis/patchSchedules/read Microsoft.Cache/redis/privateEndpointConnections/read Microsoft.Cache/redis/read Function: Reads configuration of Azure Cache for Redis (classic) instances - firewall rules, patch schedules, private endpoint connections, linked servers, TLS version [NOTE] RETIRED - Microsoft is retiring classic Redis Cache. We retain this permission specifically to continue supporting customers who still run legacy Redis instances that pre-date the retirement announcement.
Findings: Weak TLS, missing private endpoint, missing firewall rules, insecure linked server, disabled non-SSL port, missing diagnostic settings Impact

CognitiveServices (3)¶

Permission	Details
`Microsoft.CognitiveServices/accounts/deployments/read`	Function: Reads Cognitive Services / Azure OpenAI model deployments configuration Findings: Account with public access, missing private endpoint, disabled local auth not enforced, missing CMK, missing diagnostic logging, weak network ACLs Impact
`Microsoft.CognitiveServices/accounts/models/read`	Function: Reads Cognitive Services / Azure OpenAI models configuration Findings: Account with public access, missing private endpoint, disabled local auth not enforced, missing CMK, missing diagnostic logging, weak network ACLs Impact
`Microsoft.CognitiveServices/accounts/read`	Function: Reads Cognitive Services / Azure OpenAI account configuration Findings: Account with public access, missing private endpoint, disabled local auth not enforced, missing CMK, missing diagnostic logging, weak network ACLs Impact

Compute (17)¶

Permission	Details
`Microsoft.Compute/availabilitySets/read`	Function: Reads VM availability sets used for HA within a single datacenter Findings: VMs not placed in availability sets, availability set with insufficient fault domains Impact
`Microsoft.Compute/diskAccesses/read`	Function: Reads disk access resources (private endpoint configurations for managed disks) Findings: Disk with public network access when private endpoint is available, misconfigured disk access resource Impact
`Microsoft.Compute/diskEncryptionSets/read`	Function: Reads disk encryption sets used to hold customer-managed keys for disk encryption Findings: Disk encryption set using system-assigned identity, key rotation not configured, encryption at host not enabled Impact
`Microsoft.Compute/disks/read`	Function: Enumerates managed disks and reads their encryption, size, and attachment state Findings: Unencrypted managed disks, disks without customer-managed keys, orphaned disks, disks with public network access Impact
`Microsoft.Compute/galleries/read`	Function: Reads Compute Image Galleries used for shared VM images Findings: Image gallery without CMK encryption, publicly accessible image versions, missing image replication Impact
`Microsoft.Compute/locations/vmSizes/read` `Microsoft.Compute/skus/read`	Function: Reads catalog of available VM SKUs and sizes by region Findings: None directly - reference data used by other checks. Impact
`Microsoft.Compute/snapshots/read`	Function: Enumerates managed disk snapshots and their encryption state Findings: Unencrypted snapshots, snapshots with public access, stale snapshots Impact
`Microsoft.Compute/sshPublicKeys/read`	Function: Reads SSH public keys stored as Azure resources Findings: SSH keys without tags, SSH keys without associated resources Impact
`Microsoft.Compute/virtualMachineScaleSets/extensions/read`	Function: Reads extensions on VMSS resources (security agents, monitoring) Findings: VMSS without Log Analytics extension, VMSS without anti-malware, VMSS without dependency agent Impact
`Microsoft.Compute/virtualMachineScaleSets/instanceView/read`	Function: Reads runtime status of VMSS scale set instances Findings: VMSS instances failed, instances pending upgrade Impact
`Microsoft.Compute/virtualMachineScaleSets/read`	Function: Enumerates Virtual Machine Scale Sets and their configuration (SKU, capacity, upgrade policy) Findings: VMSS without managed identity, VMSS with password auth, VMSS without automatic OS upgrade, VMSS using outdated image Impact
`Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read` `Microsoft.Compute/virtualMachines/instanceView/read`	Function: Reads runtime state of VMs (power state, agent status, patch status) Findings: VM in stopped state, agent not ready, pending reboot after patches Impact
`Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read`	Function: Reads individual VM instances within a Virtual Machine Scale Set Findings: VMSS instances out of sync, unhealthy instances, unpatched instances Impact
`Microsoft.Compute/virtualMachines/extensions/read`	Function: Reads VM extensions installed on virtual machines (Log Analytics agent, anti-malware, Azure Backup, custom scripts) Findings: Log Analytics agent missing, anti-malware not installed, Azure Backup extension missing, disk encryption extension absent, dependency agent missing Impact
`Microsoft.Compute/virtualMachines/read`	Function: Enumerates virtual machines and reads their configuration (OS, SKU, network profile, identity) Findings: VMs without managed identity, VMs with password authentication, VMs without accelerated networking, unpatched OS versions, VMs on legacy SKUs Impact

Consumption (1)¶

Permission	Details
`Microsoft.Consumption/usageDetails/read`	Function: Reads billing and cost management data Findings: Cost anomalies flagged by Advisor, unusual spending patterns Impact

ContainerInstance (1)¶

Permission	Details
`Microsoft.ContainerInstance/containerGroups/read`	Function: Reads Azure Container Instances (ACI) - serverless containers Findings: ACI without private VNet integration, ACI with public IP, ACI using latest tag, ACI with excessive resource allocation Impact

ContainerRegistry (3)¶

Permission	Details
`Microsoft.ContainerRegistry/registries/read`	Function: Reads Azure Container Registry registry configuration Findings: Registry with public access, admin user enabled, missing content trust, missing quarantine policy, missing image scanning Impact
`Microsoft.ContainerRegistry/registries/replications/read`	Function: Reads Azure Container Registry registry replications configuration Findings: Registry with public access, admin user enabled, missing content trust, missing quarantine policy, missing image scanning Impact
`Microsoft.ContainerRegistry/registries/webhooks/read`	Function: Reads Azure Container Registry registry webhooks configuration Findings: Registry with public access, admin user enabled, missing content trust, missing quarantine policy, missing image scanning Impact

ContainerService (4)¶

Permission	Details
`Microsoft.ContainerService/locations/orchestrators/read`	Function: Reads available Kubernetes orchestrator versions per region Findings: None directly - reference data. Impact
`Microsoft.ContainerService/managedClusters/agentPools/read`	Function: Reads AKS node pool configuration Findings: Node pool without auto-upgrade, spot instances without eviction handling, node pool without private network, insufficient max pods Impact
`Microsoft.ContainerService/managedClusters/read`	Function: Enumerates AKS clusters and reads their configuration (Kubernetes version, network profile, identity, RBAC settings) Findings: AKS with kubenet instead of Azure CNI, missing private cluster, RBAC disabled, missing Entra ID integration, insecure API server, network policy not enforced, missing pod security policies Impact
`Microsoft.ContainerService/managedClusters/upgradeProfiles/read`	Function: Reads available Kubernetes version upgrades for AKS clusters Findings: AKS running deprecated K8s version, cluster more than 2 minor versions behind current Impact

DBforMySQL (3)¶

Permission	Details
`Microsoft.DBforMySQL/flexibleServers/configurations/read`	Function: Reads MySQL Flexible Server server parameters (my.cnf) Findings: Server with public access, SSL disabled, weak firewall rules, missing binlog configuration, insecure server parameters Impact
`Microsoft.DBforMySQL/flexibleServers/firewallRules/read`	Function: Reads MySQL Flexible Server firewall rules Findings: Server with public access, SSL disabled, weak firewall rules, missing binlog configuration, insecure server parameters Impact
`Microsoft.DBforMySQL/flexibleServers/read`	Function: Reads MySQL Flexible Server server Findings: Server with public access, SSL disabled, weak firewall rules, missing binlog configuration, insecure server parameters Impact

DBforPostgreSQL (3)¶

Permission	Details
`Microsoft.DBforPostgreSQL/flexibleServers/configurations/read`	Function: Reads PostgreSQL Flexible Server server parameters (postgresql.conf) Findings: Server with public access, SSL enforcement disabled, weak firewall rules, missing Entra ID auth, insecure server parameters (log_statement, log_connections), missing backup configuration Impact
`Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read`	Function: Reads PostgreSQL Flexible Server firewall rules Findings: Server with public access, SSL enforcement disabled, weak firewall rules, missing Entra ID auth, insecure server parameters (log_statement, log_connections), missing backup configuration Impact
`Microsoft.DBforPostgreSQL/flexibleServers/read`	Function: Reads PostgreSQL Flexible Server server Findings: Server with public access, SSL enforcement disabled, weak firewall rules, missing Entra ID auth, insecure server parameters (log_statement, log_connections), missing backup configuration Impact

DataFactory (6)¶

Permission	Details
`Microsoft.DataFactory/factories/datasets/read` `Microsoft.DataFactory/factories/linkedservices/read` `Microsoft.DataFactory/factories/pipelines/read` `Microsoft.DataFactory/factories/privateEndpointConnections/read` `Microsoft.DataFactory/factories/read` `Microsoft.DataFactory/factories/triggers/read`	Function: Reads Azure Data Factory + datasets + pipelines configuration Findings: ADF without managed identity, missing customer-managed key, linked services with plaintext credentials, pipeline exposed to public network Impact

Databricks (1)¶

Permission	Details
`Microsoft.Databricks/workspaces/read`	Function: Enumerates Azure Databricks workspaces Findings: Databricks with public IP, missing VNet injection, missing customer-managed key, missing private link Impact

Devices (1)¶

Permission	Details
`Microsoft.Devices/IotHubs/read`	Function: Reads Azure IoT Hub configuration Findings: IoT Hub with public access, weak SAS policies, missing device authentication policies, weak encryption Impact

EventGrid (2)¶

Permission	Details
`Microsoft.EventGrid/domains/read`	Function: Reads Event Grid domain configuration (custom topics grouped as domains) Findings: Domain with public network access, missing private endpoint, weak input schema, missing CMK Impact
`Microsoft.EventGrid/topics/read`	Function: Reads Event Grid topic configuration Findings: Topic with public access, missing IP firewall, missing managed identity for delivery Impact

EventHub (4)¶

Permission	Details
`Microsoft.EventHub/namespaces/authorizationRules/read`	Function: Reads shared access authorization rules on Event Hub namespaces Findings: SAS keys with Manage rights, root SAS keys still active, missing key rotation Impact
`Microsoft.EventHub/namespaces/eventhubs/read`	Function: Reads individual Event Hubs within namespaces Findings: Event Hub with excessive retention, missing capture configuration Impact
`Microsoft.EventHub/namespaces/networkRuleSets/read`	Function: Reads network rules (IP and VNet) on Event Hub namespaces Findings: Event Hub with default action Allow, missing VNet rules, wide-open IP filter Impact
`Microsoft.EventHub/namespaces/read`	Function: Enumerates Event Hub namespaces Findings: Event Hub with public access, missing private endpoint, weak minimum TLS Impact

GuestConfiguration (1)¶

Permission	Details
`Microsoft.GuestConfiguration/guestConfigurationAssignments/read`	Function: Reads guest configuration assignments (in-guest policy on VMs) Findings: VMs without guest configuration extension, non-compliant OS baselines, missing password policies, missing audit policies Impact

Insights (6)¶

Permission	Details
`Microsoft.Insights/actionGroups/read`	Function: Reads action group configurations (who gets notified when alerts fire) Findings: Alert rules without action groups, action groups without recipients, action groups with SMS-only notification Impact
`Microsoft.Insights/activityLogAlerts/read`	Function: Reads activity log alert rules (alerts triggered by control-plane events) Findings: Missing alert for NSG changes, missing alert for role assignment changes, missing alert for Key Vault operations, missing alert for firewall rule changes Impact
`Microsoft.Insights/autoscalesettings/read`	Function: Reads autoscale rules on VM Scale Sets, App Service Plans Findings: Missing autoscale on production workloads, autoscale limits too low/high, single-instance production deployments Impact
`Microsoft.Insights/components/read`	Function: Reads Application Insights instances Findings: App Insights without workspace mode, missing sampling policies, missing CMK encryption Impact
`Microsoft.Insights/metricAlerts/read`	Function: Reads metric-based alert rules Findings: Missing CPU alerts, missing network transfer alerts, missing failed sign-in alerts Impact
`Microsoft.Insights/metrics/read`	Function: Reads Azure Monitor metric definitions Findings: None directly - metric data. Impact

KeyVault (7)¶

Permission	Details
`Microsoft.KeyVault/checkNameAvailability/read` `Microsoft.KeyVault/locations/deletedVaults/read` `Microsoft.KeyVault/locations/operationResults/read` `Microsoft.KeyVault/operations/read`	Function: Reads Key Vault service-level metadata (name availability, operation results, locations) Findings: None directly - service catalog data. Impact
`Microsoft.KeyVault/vaults/keys/read`	Function: Enumerates keys stored in Key Vaults and reads their metadata Findings: Keys without expiration date, keys older than rotation policy, keys without automatic rotation, weak key sizes Impact
`Microsoft.KeyVault/vaults/read`	Function: Enumerates Key Vaults and reads their SKU, access policies, and network ACLs Findings: Key Vault with public network access, missing purge protection, soft-delete disabled, missing private endpoint, RBAC not enabled, access policies with wildcard permissions Impact
`Microsoft.KeyVault/vaults/secrets/read`	Function: Enumerates secrets stored in Key Vaults (metadata only, not values) Findings: Secrets without expiration, disabled secrets not cleaned up, secrets past expiration still in use Impact

Kusto (1)¶

Permission	Details
`Microsoft.Kusto/clusters/read`	Function: Reads Azure Data Explorer (Kusto) cluster configuration Findings: Kusto cluster with public access, missing private endpoint, missing CMK, weak network configuration Impact

MachineLearningServices (2)¶

Permission	Details
`Microsoft.MachineLearningServices/workspaces/computes/read`	Function: Reads Azure Machine Learning compute clusters and instances configuration Findings: ML workspace with public access, missing HBI (High Business Impact) flag, missing CMK, compute with public IP, missing SSH restriction, missing diagnostic logging Impact
`Microsoft.MachineLearningServices/workspaces/read`	Function: Reads Azure Machine Learning workspace configuration Findings: ML workspace with public access, missing HBI (High Business Impact) flag, missing CMK, compute with public IP, missing SSH restriction, missing diagnostic logging Impact

Maintenance (1)¶

Permission	Details
`Microsoft.Maintenance/maintenanceConfigurations/read`	Function: Reads maintenance configurations (planned patching windows) Findings: VMs without maintenance configuration, patch orchestration missing Impact

ManagedServices (2)¶

Permission	Details
`Microsoft.ManagedServices/registrationAssignments/read` `Microsoft.ManagedServices/registrationDefinitions/read`	Function: Reads Azure Lighthouse delegated resource management assignments Findings: Excessive Lighthouse delegations, missing tenant boundaries Impact

Network (37)¶

Permission	Details
`Microsoft.Network/applicationGatewayWebApplicationFirewallPolicies/read`	Function: Reads WAF policies attached to Application Gateways Findings: WAF in Detection mode instead of Prevention, missing OWASP rule set, WAF policy without custom rules for known threats Impact
`Microsoft.Network/applicationGateways/read`	Function: Reads Application Gateway configuration (listeners, SSL, WAF) Findings: App Gateway without WAF, weak SSL policy, missing HTTP to HTTPS redirect, self-signed certificates Impact
`Microsoft.Network/applicationSecurityGroups/read`	Function: Reads Network applicationSecurityGroups configuration Findings: Depends on the specific plugin using this permission. Impact
`Microsoft.Network/azureFirewalls/read`	Function: Reads Azure Firewall and firewall policy configuration Findings: Firewall in Alert-only mode, missing IDPS, threat intel not enabled, permissive application rules Impact
`Microsoft.Network/bastionHosts/read`	Function: Reads Azure Bastion hosts Findings: Bastion with Basic SKU (weaker features), Bastion without native client support, missing shareable link controls Impact
`Microsoft.Network/dnszones/read` `Microsoft.Network/privateDnsZones/read` `Microsoft.Network/privateDnsZones/virtualNetworkLinks/read`	Function: Reads public and private DNS zones Findings: DNS zone without DNSSEC, private DNS not linked to VNet, dangling DNS records Impact
`Microsoft.Network/expressRouteCircuits/read`	Function: Reads ExpressRoute circuit configurations for private hybrid connectivity Findings: ExpressRoute without BGP MD5 authentication, missing FastPath, weak peering configuration Impact
`Microsoft.Network/loadBalancers/backendAddressPools/read`	Function: Reads load balancer backend address pools configuration Findings: LB with public IP where private would suffice, missing health probes, insecure LB rules exposing internal services Impact
`Microsoft.Network/loadBalancers/frontendIPConfigurations/read`	Function: Reads load balancer frontend IP configurations configuration Findings: LB with public IP where private would suffice, missing health probes, insecure LB rules exposing internal services Impact
`Microsoft.Network/loadBalancers/inboundNatRules/read`	Function: Reads load balancer inbound NAT rules configuration Findings: LB with public IP where private would suffice, missing health probes, insecure LB rules exposing internal services Impact
`Microsoft.Network/loadBalancers/loadBalancingRules/read`	Function: Reads load balancer rules configuration Findings: LB with public IP where private would suffice, missing health probes, insecure LB rules exposing internal services Impact
`Microsoft.Network/loadBalancers/outboundRules/read`	Function: Reads load balancer outbound rules configuration Findings: LB with public IP where private would suffice, missing health probes, insecure LB rules exposing internal services Impact
`Microsoft.Network/loadBalancers/probes/read`	Function: Reads load balancer health probes configuration Findings: LB with public IP where private would suffice, missing health probes, insecure LB rules exposing internal services Impact
`Microsoft.Network/loadBalancers/read`	Function: Reads load balancer configuration Findings: LB with public IP where private would suffice, missing health probes, insecure LB rules exposing internal services Impact
`Microsoft.Network/locations/serviceTags/read`	Function: Reads Azure service tag definitions used for NSG rule reasoning Findings: None directly - reference data. Impact
`Microsoft.Network/locations/usages/read`	Function: Reads Network locations usages configuration Findings: Depends on the specific plugin using this permission. Impact
`Microsoft.Network/natGateways/read`	Function: Reads NAT Gateway configuration for outbound connectivity Findings: Subnets without NAT Gateway using default outbound (deprecated), missing NAT for private endpoints Impact
`Microsoft.Network/networkInterfaces/ipConfigurations/read`	Function: Reads Network networkInterfaces ipConfigurations configuration Findings: Depends on the specific plugin using this permission. Impact
`Microsoft.Network/networkInterfaces/read`	Function: Reads network interfaces attached to VMs Findings: NIC with IP forwarding enabled, NIC without NSG association, NIC with accelerated networking disabled Impact
`Microsoft.Network/networkProfiles/read`	Function: Reads network profiles used by Container Instances Findings: Container instance in public subnet, ACI without private subnet integration Impact
`Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read`	Function: Reads default (built-in) NSG rules that Azure provides automatically Findings: None directly - reference data used to distinguish default vs custom rules. Impact
`Microsoft.Network/networkSecurityGroups/read`	Function: Enumerates NSGs and their associated subnets and network interfaces Findings: Subnets without NSG association, NSG with all rules permissive, orphaned NSGs, NSG missing on public-facing subnet Impact
`Microsoft.Network/networkSecurityGroups/securityRules/read`	Function: Reads custom inbound and outbound security rules defined on Network Security Groups Findings: Wide-open inbound rules (0.0.0.0/0), SSH/RDP open to Internet, database ports exposed publicly, permissive outbound rules Impact
`Microsoft.Network/networkWatchers/flowLogs/read`	Function: Reads NSG flow log configuration Findings: NSG without flow logs enabled, flow logs without traffic analytics, insufficient flow log retention Impact
`Microsoft.Network/networkWatchers/read`	Function: Reads Network Watcher services per region Findings: Network Watcher not enabled in region Impact
`Microsoft.Network/privateEndpoints/read`	Function: Reads Network privateEndpoints configuration Findings: Depends on the specific plugin using this permission. Impact
`Microsoft.Network/publicIPAddresses/read`	Function: Enumerates public IP addresses and their associations Findings: Orphaned public IPs, public IPs on non-production resources, basic SKU public IPs (deprecated), public IPs without DDoS protection Impact
`Microsoft.Network/routeTables/read`	Function: Reads user-defined routes (UDRs) and route tables Findings: Missing default route to firewall/NVA, UDR bypassing security appliances Impact
`Microsoft.Network/routeTables/routes/read`	Function: Reads Network routeTables routes configuration Findings: Depends on the specific plugin using this permission. Impact
`Microsoft.Network/virtualNetworkGateways/read`	Function: Reads VPN and ExpressRoute gateways for hybrid connectivity Findings: Gateway using weak SKU, missing active-active configuration, weak IPsec policy Impact
`Microsoft.Network/virtualNetworks/read`	Function: Enumerates virtual networks and reads their address space and configuration Findings: VNets without DDoS protection, VNets with overlapping ranges, VNets without flow logs Impact
`Microsoft.Network/virtualNetworks/subnets/read`	Function: Reads subnets within virtual networks (address range, delegation, service endpoints, private endpoint policy) Findings: Subnet without NSG, subnet without service endpoints, subnet allowing multiple delegations, subnet with overly permissive private endpoint policy Impact
`Microsoft.Network/virtualNetworks/subnets/resourceNavigationLinks/read` `Microsoft.Network/virtualNetworks/subnets/serviceAssociationLinks/read`	Function: Reads links between subnets and the resources that use them Findings: None directly - dependency data for other checks. Impact
`Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read`	Function: Reads VNet peering configurations between virtual networks Findings: Peering without gateway transit control, peering allowing forwarded traffic, unauthorized cross-tenant peerings Impact

OperationalInsights (1)¶

Permission	Details
`Microsoft.OperationalInsights/workspaces/read`	Function: Reads Log Analytics workspace configuration Findings: Missing Log Analytics workspace, workspace with default retention (too short), missing security solutions installed, workspace not linked to Defender Impact

RecoveryServices (3)¶

Permission	Details
`Microsoft.RecoveryServices/vaults/backupPolicies/read`	Function: Reads backup policies configured in Recovery Services vaults Findings: Backup retention below policy minimum, missing weekly backups, missing yearly backups for compliance Impact
`Microsoft.RecoveryServices/vaults/backupProtectedItems/read`	Function: Reads items protected by Azure Backup (VMs, SQL DBs, file shares) Findings: Critical VMs without backup, databases without backup, backup jobs failing repeatedly Impact
`Microsoft.RecoveryServices/vaults/read`	Function: Enumerates Recovery Services vaults Findings: Vault with soft delete disabled, missing immutability, missing CMK, missing private endpoint, cross-subscription restore disabled Impact

ResourceGraph (4)¶

Permission	Details
`Microsoft.ResourceGraph/operations/read` `Microsoft.ResourceGraph/resourceChanges/read` `Microsoft.ResourceGraph/resources/read` `Microsoft.ResourceGraph/resourcesHistory/read`	Function: Enables cross-scope resource querying via Azure Resource Graph Findings: None directly - foundational for Defender inventory. Impact

Resources (9)¶

Permission	Details
`Microsoft.Resources/deployments/read`	Function: Reads ARM deployment history for the subscription Findings: Failed deployments retained, sensitive parameters in deployment history Impact
`Microsoft.Resources/links/read`	Function: Reads resource links (cross-resource dependencies) Findings: Undocumented cross-resource dependencies Impact
`Microsoft.Resources/providers/read`	Function: Reads the list of registered Azure resource providers Findings: Deprecated providers still registered, security-relevant providers not registered Impact
`Microsoft.Resources/resources/read` `Microsoft.Resources/subscriptions/resources/read`	Function: Enumerates all Azure resources across the subscription regardless of resource group Findings: Orphaned resources, resources without tags, resources missing required governance metadata Impact
`Microsoft.Resources/subscriptions/locations/read`	Function: Reads the list of Azure regions available to the subscription Findings: None - reference data used by region-scoped scans. Impact
`Microsoft.Resources/subscriptions/read`	Function: Enumerates the Azure subscription and its metadata (tenant ID, tags, state, quota) Findings: None - this is foundational. Without it, no findings can be produced. Impact
`Microsoft.Resources/subscriptions/resourceGroups/read`	Function: Enumerates resource groups within the subscription Findings: Resource groups without tags, resource groups without management locks, empty resource groups Impact
`Microsoft.Resources/tenants/read`	Function: Reads Entra tenant metadata visible to the subscription Findings: None - reference data. Impact

Search (1)¶

Permission	Details
`Microsoft.Search/searchServices/read`	Function: Reads Azure Cognitive Search services Findings: Search with public access, missing private endpoint, admin keys not rotated, missing CMK encryption Impact

ServiceBus (5)¶

Permission	Details
`Microsoft.ServiceBus/namespaces/authorizationRules/read`	Function: Reads Service Bus authorization rules configuration Findings: SB namespace with public access, missing private endpoint, permissive SAS keys, wildcard IP filter, missing local auth disabled Impact
`Microsoft.ServiceBus/namespaces/privateEndpointConnections/read`	Function: Reads Service Bus private endpoints configuration Findings: SB namespace with public access, missing private endpoint, permissive SAS keys, wildcard IP filter, missing local auth disabled Impact
`Microsoft.ServiceBus/namespaces/queues/read`	Function: Reads Service Bus queues configuration Findings: SB namespace with public access, missing private endpoint, permissive SAS keys, wildcard IP filter, missing local auth disabled Impact
`Microsoft.ServiceBus/namespaces/read`	Function: Reads Service Bus namespace configuration Findings: SB namespace with public access, missing private endpoint, permissive SAS keys, wildcard IP filter, missing local auth disabled Impact
`Microsoft.ServiceBus/namespaces/topics/read`	Function: Reads Service Bus topics configuration Findings: SB namespace with public access, missing private endpoint, permissive SAS keys, wildcard IP filter, missing local auth disabled Impact

SignalRService (1)¶

Permission	Details
`Microsoft.SignalRService/SignalR/read`	Function: Reads Azure SignalR Service configuration for real-time messaging Findings: SignalR with public access, missing private endpoint, weak feature flags Impact

Sql (28)¶

Permission	Details
`Microsoft.Sql/managedInstances/read`	Function: Reads Sql managedInstances configuration Findings: Depends on the specific plugin using this permission. Impact
`Microsoft.Sql/servers/administrators/read`	Function: Reads SQL server Entra ID administrator configuration Findings: SQL server without Entra ID admin, SQL admin is a user instead of a group Impact
`Microsoft.Sql/servers/advancedThreatProtectionSettings/read` `Microsoft.Sql/servers/securityAlertPolicies/read`	Function: Reads Advanced Threat Protection and security alert policies on SQL servers Findings: ATP disabled, alert emails not configured, security alerts not sent to admins Impact
`Microsoft.Sql/servers/auditingSettings/read`	Function: Reads server-level SQL auditing configuration Findings: Server auditing disabled, audit log destination missing, insufficient retention Impact
`Microsoft.Sql/servers/connectionPolicies/read`	Function: Reads SQL server connection policy (Default vs Proxy vs Redirect) Findings: Connection policy set to Proxy where Redirect would be more secure Impact
`Microsoft.Sql/servers/databases/auditingSettings/read`	Function: Reads SQL database auditing configuration Findings: Database auditing disabled, audit log retention too short, audit not sent to Log Analytics/storage Impact
`Microsoft.Sql/servers/databases/automaticTuning/read`	Function: Reads automatic tuning settings on SQL databases Findings: Automatic tuning disabled, force plan not enabled Impact
`Microsoft.Sql/servers/databases/backupShortTermRetentionPolicies/read`	Function: Reads short-term backup retention policy on SQL databases Findings: Backup retention below regulatory minimum, missing PITR configuration Impact
`Microsoft.Sql/servers/databases/currentSensitivityLabels/read` `Microsoft.Sql/servers/databases/sensitivityLabels/read`	Function: Reads sensitivity labels (data classification) on SQL database columns Findings: Sensitive columns unclassified, missing PII classification, no confidentiality labels Impact
`Microsoft.Sql/servers/databases/dataMaskingPolicies/read`	Function: Reads dynamic data masking rules on SQL databases Findings: No data masking on PII columns, data masking disabled Impact
`Microsoft.Sql/servers/databases/ledgerDigestUploads/read`	Function: Reads Ledger digest upload configuration (SQL Ledger tamper evidence) Findings: Ledger enabled without digest uploads, missing digest storage Impact
`Microsoft.Sql/servers/databases/read`	Function: Enumerates SQL databases within SQL servers Findings: Databases without TDE, databases in wrong SKU, deprecated compatibility levels, databases without backup configuration Impact
`Microsoft.Sql/servers/databases/syncGroups/read`	Function: Reads SQL Data Sync group configuration Findings: Sync group without conflict resolution policy Impact
`Microsoft.Sql/servers/databases/transparentDataEncryption/read`	Function: Reads Transparent Data Encryption (TDE) status on SQL databases Findings: TDE disabled, TDE using service-managed key instead of customer-managed key Impact
`Microsoft.Sql/servers/databases/vulnerabilityAssessments/read` `Microsoft.Sql/servers/databases/vulnerabilityAssessments/scans/read`	Function: Reads SQL database vulnerability assessment configuration and scan results Findings: Vulnerability assessment not configured, missing storage for scan results, unresolved high-severity findings Impact
`Microsoft.Sql/servers/devOpsAuditingSettings/read`	Function: Reads DevOps auditing settings on SQL servers Findings: DevOps auditing not enabled Impact
`Microsoft.Sql/servers/elasticPools/read`	Function: Reads SQL elastic pool configuration Findings: Elastic pool overprovisioned, elastic pool with wrong SKU, single-database configuration where elastic pool would be more efficient Impact
`Microsoft.Sql/servers/encryptionProtector/read`	Function: Reads encryption protector (CMK) configuration on SQL servers Findings: SQL server using service-managed key instead of CMK, encryption protector not rotated Impact
`Microsoft.Sql/servers/failoverGroups/read`	Function: Reads SQL failover group configuration for HA/DR Findings: Missing failover group, secondary in same region as primary, manual failover configured for critical DB Impact
`Microsoft.Sql/servers/firewallRules/read` `Microsoft.Sql/servers/outboundFirewallRules/read`	Function: Reads SQL server firewall rules Findings: Firewall rule allowing 0.0.0.0-255.255.255.255, permissive Azure services rule, missing IP restriction Impact
`Microsoft.Sql/servers/read`	Function: Enumerates SQL servers and reads their configuration Findings: SQL server with public network access, missing minimum TLS version, missing Entra ID admin, weak firewall rules Impact
`Microsoft.Sql/servers/restorableDroppedDatabases/read`	Function: Reads databases marked for deletion but still recoverable Findings: Excessive number of dropped databases retained, dropped databases containing sensitive data Impact
`Microsoft.Sql/servers/virtualNetworkRules/read`	Function: Reads VNet rules on SQL servers (private access through subnets) Findings: SQL server without VNet rules, VNet rules missing ignore-missing-endpoint flag Impact
`Microsoft.Sql/servers/vulnerabilityAssessments/read`	Function: Reads server-level vulnerability assessment configuration Findings: Server-level VA not configured, VA storage account missing Impact

Storage (14)¶

Permission	Details
`Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/read`	Function: Reads WORM (Write Once Read Many) immutability policies on blob containers Findings: Container without immutability policy where required, unlocked immutability policies, insufficient retention period Impact
`Microsoft.Storage/storageAccounts/blobServices/containers/read`	Function: Enumerates blob containers within storage accounts and reads their access level Findings: Anonymous public read access, publicly accessible container, missing CMK encryption on container, missing immutability policy Impact
`Microsoft.Storage/storageAccounts/blobServices/read`	Function: Reads blob service properties (versioning, soft delete, change feed, encryption) Findings: Blob soft delete disabled, versioning disabled, missing change feed, insufficient retention Impact
`Microsoft.Storage/storageAccounts/encryptionScopes/read`	Function: Reads encryption scope configurations on storage accounts Findings: Encryption scope using Microsoft-managed key instead of CMK, infrastructure encryption disabled Impact
`Microsoft.Storage/storageAccounts/fileServices/read` `Microsoft.Storage/storageAccounts/fileServices/shares/read`	Function: Enumerates Azure File shares and reads share-level access settings Findings: File share with public access, missing SMB security settings, insecure share permissions Impact
`Microsoft.Storage/storageAccounts/localUsers/read`	Function: Reads local users configured on storage accounts (SFTP feature) Findings: SFTP enabled without home directory, SSH key auth disabled, weak permission scope Impact
`Microsoft.Storage/storageAccounts/managementPolicies/read`	Function: Reads lifecycle management policies on storage accounts Findings: Missing lifecycle policy, no tier-down policy for cold data, missing automatic deletion for expired blobs Impact
`Microsoft.Storage/storageAccounts/privateEndpointConnections/read`	Function: Reads private endpoint connections on storage accounts Findings: Storage account with public network access despite having private endpoint, dangling private endpoint connections Impact
`Microsoft.Storage/storageAccounts/queueServices/queues/read` `Microsoft.Storage/storageAccounts/queueServices/read`	Function: Enumerates storage queues and reads queue service logging Findings: Queue service logging disabled, queue without CMK encryption Impact
`Microsoft.Storage/storageAccounts/read`	Function: Enumerates storage accounts and their properties (SKU, kind, encryption, TLS version, network rules) Findings: Public blob access enabled, TLS 1.0/1.1 allowed, HTTPS not enforced, network access unrestricted, missing customer-managed key encryption, insecure default action Impact
`Microsoft.Storage/storageAccounts/tableServices/read` `Microsoft.Storage/storageAccounts/tableServices/tables/read`	Function: Enumerates storage tables and reads table service logging Findings: Table service logging disabled, table without CMK encryption Impact

StorageCache (1)¶

Permission	Details
`Microsoft.StorageCache/caches/read`	Function: Reads Azure HPC Cache configuration (high-performance storage caching) Findings: HPC Cache without encryption, missing network security, exposed cache endpoints Impact

StorageSync (1)¶

Permission	Details
`Microsoft.StorageSync/storageSyncServices/read`	Function: Reads Azure File Sync services, sync groups, and registered servers Findings: File Sync without cloud tiering security, unregistered sync endpoints, sync group with public network access Impact

StreamAnalytics (4)¶

Permission	Details
`Microsoft.StreamAnalytics/streamingjobs/inputs/read` `Microsoft.StreamAnalytics/streamingjobs/outputs/read` `Microsoft.StreamAnalytics/streamingjobs/read` `Microsoft.StreamAnalytics/streamingjobs/transformations/read`	Function: Reads Stream Analytics job configuration Findings: Stream Analytics job without managed identity, missing CMK on input/output storage, jobs with excessive privileges Impact

Web (10)¶

Permission	Details
`Microsoft.Web/hostingEnvironments/read`	Function: Reads App Service Environment (ASE) configuration Findings: ASE with internal load balancer misconfigured, ASE without WAF, weak inbound network rules Impact
`Microsoft.Web/serverFarms/read`	Function: Enumerates App Service Plans and reads their SKU and capacity Findings: App Service Plan with basic SKU (no autoscale, no staging slots), single-instance plans without HA Impact
`Microsoft.Web/serverFarms/sites/read`	Function: Reads the list of sites within each App Service Plan Findings: None directly - relational data. Impact
`Microsoft.Web/sites/config/read`	Function: Reads Web App / Function App configuration (auth, HTTPS settings, TLS version, remote debugging) Findings: HTTPS not enforced, weak minimum TLS, remote debugging enabled, client cert not required, insecure FTP state, weak CORS policy, missing Always On Impact
`Microsoft.Web/sites/functions/read`	Function: Reads Function App function definitions Findings: Functions with anonymous auth level, missing function-level auth Impact
`Microsoft.Web/sites/read`	Function: Enumerates Web Apps, Function Apps, and Logic Apps and reads their metadata Findings: App with public network access, missing managed identity, using deprecated runtime, missing diagnostic logging Impact
`Microsoft.Web/sites/slots/config/read`	Function: Reads configuration of App Service deployment slots (staging, production) Findings: Slot with different security config than production, slot missing HTTPS enforcement Impact
`Microsoft.Web/sites/slots/read`	Function: Enumerates App Service deployment slots Findings: Slot without VNet integration, slot with default hostname exposed Impact
`Microsoft.Web/sites/sourceControls/read`	Function: Reads source control integration (GitHub, Azure DevOps) on App Services Findings: App deploying from untrusted repository, credentials stored in source control config Impact
`Microsoft.Web/sites/virtualNetworkConnections/read`	Function: Reads VNet integration configuration on App Services Findings: App Service without VNet integration, missing regional VNet integration Impact

Support for retired Azure services¶

The role deliberately keeps permissions for several Azure services Microsoft has retired for new customers. Many customers still run legacy instances, so retaining these permissions means AccuKnox continues to report the full security posture during migration instead of showing a misleadingly clean scan.

Retired service	Retirement status	Permission retained	Support this provides
Redis Cache (classic)	Microsoft is migrating customers to Azure Managed Redis. Existing classic Redis instances continue to work.	`Microsoft.Cache/redis/*`	Full scan of TLS enforcement, firewall rules, private endpoint, non-SSL port, diagnostic settings on legacy Redis instances.
Azure Spring Cloud	Retired for new customers. Existing Spring Cloud services still operational.	`Microsoft.AppPlatform/*`	Continued audit of Spring app deployments, TLS settings, network access, encryption for existing customers.
PostgreSQL Single Server	Retired by Microsoft in March 2025. Customers must migrate to Flexible Server but many have not yet.	`Microsoft.DBforPostgreSQL/servers/read`	Continued audit of SSL enforcement, log_checkpoints, firewall rules, threat detection on legacy PG single-server instances during migration period.
MySQL Single Server	Retired by Microsoft. Customers must migrate to MySQL Flexible Server.	`Microsoft.DBforMySQL/servers/read`	Continued audit of SSL enforcement, weak TLS, threat detection, firewall rules on legacy MySQL single-server instances.
Azure Front Door (classic)	Microsoft strongly encourages migration to Front Door Standard/Premium. Classic Front Door still operational.	`Microsoft.Network/frontdoors/*`	Continued audit of classic Front Door WAF policies, SSL configuration, custom rules until customers migrate.

Customer value

By retaining these permissions, we provide continuous security posture visibility during the customer's migration window from legacy to current-generation Azure services. A competitor scanner that only supports current-generation services will show a clean scan while legacy services remain unaudited. Our scanner reports the full picture, including the legacy services where security incidents are more likely due to reduced Microsoft support.