VM-Series on Azure Service Principal Permissions

Review the granular permissions for the Service Principal for VM-Series integrations
For Panorama to interact with the Azure APIs and collect information on your workloads, you need to create an Azure Active Directory Service Principal. This Service Principal has the permissions required to authenticate to the Azure AD and access the resources within your subscription. To complete the set up, you must have permissions to register an application with your Azure AD tenant, and assign the application to a role in your subscription. If you don't have the necessary permissions, ask your Azure AD or subscription administrator to create a Service Principal. The following table lists the minimumbuilt-in roles required and the granular permissions if you would like to customize the role.
To support
Permissions
Azure High Availability
Set up Active/Passive HA on Azure
Microsoft.Authorization/*/read
Microsoft.Network/networkInterfaces/*
Microsoft.Network/networkSecurityGroups/*
Microsoft.Network/virtualNetworks/*
Microsoft.Compute/virtualMachines/read
Microsoft.Authorization/*/read
Microsoft.Network/networkInterfaces/*
Microsoft.Network/networkSecurityGroups/*
Microsoft.Network/virtualNetworks/*
Microsoft.Compute/virtualMachines/read
Requires a minimum Role of
Contributor
for Service Principal.Alternatively, you can add the following custom permissions:
Microsoft.Network/virtualNetworks/read
Microsoft.Network/routeTables/read
Microsoft.Network/loadBalancers/read
Microsoft.Insights/components/read
Microsoft.Network/publicIPAddresses/read
Microsoft.Network/applicationGateways/read
Microsoft.Compute/virtualMachineScaleSets/read
Microsoft.Insights/autoscalesettings/read
Requires a minimum Role of
Reader
for Service Principal.Alternatively, you can add the following custom permissions:
Microsoft.Compute/virtualMachines/read
Microsoft.Network/networkInterfaces/read
Microsoft.Network/virtualNetworks/read

Recommended For You