- 13 minutes to read

Azure Least Privilege Role Assignments for Nodinite Agents

This page is the canonical permission reference for all Nodinite Azure agents. Use it to assign only the roles each agent actually needs — no more, no less.

Info

This is a companion to the Azure Application Access guide, which covers App Registration setup, TenantId/SubscriptionId/ClientId retrieval, and role assignment steps. Start there if you have not yet created an App Registration.

Agents covered

The role assignments on this page apply to:

The Nodinite Pickup Log Events Service Logging Agent does not use the Azure REST API. Instead, it uses information from the Shared access policies.

Important

If you opt to allow the Client/Application the Contributor role on each Subscription to monitor and manage, then you do not have to fine-tune the Role Assignments, with some exceptions. Please review the following:

  • Application Insights/Functions Monitoring — you need an API Key.
  • App Registrations
  • App Services (Function App and Web App)
  • Event Hub (Post data)
  • Function App

Permission table

Clone a role

Keep in mind that updating Azure role assignments may take up to five minutes to propagate. Then, you need to restart the necessary Nodinite agents.

Resource Role Agent Purpose
Subscription Reader Show Details and Match/Validate the Subscription Id with the current configuration.
NOTE: This right inherits to all other Resources in selected Subscription.
API Management Service API Management Service Contributor List resources, Create and delete EventHub Logger, Invoke APIs
App Registrations Microsoft.Graph - Application.Read.All List App Registration, SSO assignments, Branding info and evaluate Secrets
NOTE: The type must be Application, NOT delegated
App Registrations - Owners (Details page) Microsoft.Graph - User.Read.All List details about Owners
NOTE: The type must be Application, NOT delegated
App Registrations - Grant status (API Permissions) Microsoft.Graph - DelegatedPermissionGrant.Read.All Read the permission-grant status for the selected App Registration.
NOTE: This is a delegated Graph permission; unlike Application.Read.All and User.Read.All, it is added under Delegated permissions, not Application permissions.
App Services (Function App and Web App) Website Contributor List Web Sites
Get Web Site
List Web Jobs
Get Web Job

Web Jobs (the following features require the 'SCM Basic Auth Publishing Credentials' setting to be set to On)
  • Fetch publishing profile
  • View Web Jobs History
  • Run Triggered Web Job
  • Start/Stop Continous Web Job
Application Insights
  • Reader (read the Component configuration)
  • Application Insights API - Data.Read (NOTE: Delegated permission)New 6.3.x
 View all resources, but does not allow you to make any changes.
Execute Kusto queries and allow the Functions Monitoring
Application Insights NOTE: Version >= 6.3.0.0 does not use the API Key any more.
API Key (required to get the statistics for Function App Monitoring, additional access rights are required, please review the Function App in this table)		 Not a role-assignment You must manually create an API Key (from the side bar menu 'API Access' in the Azure portal) for each Application Insights instance. API access is required for the Function App Monitoring. If the API key expires, you need to re-create it
Data Factory Data Factory Contributor List Data Factories and pipelines, Read Details, Read performance
Event Grid EventGrid EventSubscription Reader Lets you read Event Grid event subscriptions.
Event Hubs Azure Event Hubs Data Sender Send DATA to the Event Hub entity and checkpoint event processing state to blob storage
Event Hubs Azure Event Hubs Data Receiver Receive DATA from the Event Hub entity
Function App
  • 1. Website Contributor
  • 2. Reader
  • 1. List resources
  • 2. View all resources, but does not allow you to make any changes
    Read configuration to explore Application Insights
Resource Group Reader Show Details and Match/Validate the Resource Group with the current configuration.
NOTE: This right inherits to all other Resources in selected Resource Group.
Service Bus Namespace Azure Service Bus Data Owner List namespaces and Resources, Read and use Access Keys, Manage Queues and Topics
Key Vaults Key Vault Reader List Key vaults and reads meta data (does not read the actual secrets!)
NOTE: Azure role-based access control (recommended) must be set in the 'Settings |Access configuration'.
Azure Cosmos DB account DocumentDB Account Contributor Read account metadata, discover databases and containers, and manage account-level settings such as throughput changes and key regeneration for the monitored Cosmos DB estate.
Logic App Logic App Operator Enable/Disable Logic App. This role is NOT allowed to Resubmit runs
Logic Apps Logic App Contributor Allow to Resubmit runs. If you assign membership with this role; The Client does not need to be a member of the Logic App Operator role
Storage Account Reader and Data Access
NOTE:If you add this role, you do not need all the other specific role assignments
 Lets you view everything but will not let you delete or create a storage account or contained resource. It will also allow read/write access to all data contained in a storage account via access to storage account keys.
Storage Account - Blob (Read) Storage Blob Data Reader Read and list Azure Storage containers and blobs
Storage Account - Blob (Read/Write/Delete) Storage Blob Data Contributor Read, write, and delete Azure Storage containers and blobs. Pickup Service uses this for Event Hub checkpoint storage.
Storage Account - File (Read/Write) Storage File Data SMB Share Reader Allows for read access on files/directories in Azure file shares.
Storage Account - File (Delete) Storage File Data SMB Share Contributor Allows for read, write, and delete access on files/directories in Azure file shares.
Storage Account - Queue (Read) Storage Queue Data Reader Read and list Azure Storage queues and queue messages.
Storage Account - Queue (Send/Post) Storage Queue Data Message Sender Add messages to an Azure Storage queue.
Storage Account - Queue (Delete) Storage Queue Data Contributor Read, write, and delete Azure Storage queues and queue messages.

Note

In Azure Portal, You can either assign role memberships on each Resource, or you can set the role assignment on the Resource Group, or Subscription level. [!IMPORTANT] You must restart the agent after changing role assignments since the token is cached and needs to be updated. Otherwise, it may take up to one hour for changes to be in effect.

Creating a Custom Azure Role (Quick Reference)

If you're creating a custom Azure role (e.g., "Nodinite Monitoring") instead of using built-in roles, you'll need to add specific Actions to your custom role definition. This approach follows the principle of least privilege by granting only the exact permissions required.

Tip

You can either:

  • Use the built-in roles listed in the table above (easier setup, may grant more permissions than needed)
  • Create a custom role with only the Actions listed here (more secure, follows least privilege principle)

Microsoft Graph API Permissions

These permissions must be configured in API Permissions (not IAM/RBAC). In the Azure portal, the App Registration permissions section is separate from Azure RBAC role assignments.

The permissions commonly used for App Registration monitoring are:

  • Application.Read.All - List App Registrations, SSO assignments, branding info, and evaluate secrets
  • User.Read.All - Read details about App Registration owners

There is also a separate Microsoft Graph permission that can trigger the runtime warning in the agent:

  • DelegatedPermissionGrant.Read.All - Read the permission-grant status for the selected App Registration. This is a delegated Graph permission, unlike Application.Read.All and User.Read.All, which are application permissions. It is not an Azure RBAC role and is not the same as the Azure role assignment on the target subscription or resource group.

Note

If you are comparing this guide with the App Registration screenshot, the expected state is that the app metadata permissions are present and show Granted after admin consent. If those permissions are already applied, but the agent still warns that it cannot read grant status, the remaining issue is usually either the missing DelegatedPermissionGrant.Read.All permission, an incomplete admin-consent state, or the Azure access token still being cached. If all Graph permissions are granted and the warning persists, then the remaining issue is typically the Azure RBAC assignment on the target subscription, resource group, or resource.

Azure RBAC Actions for Custom Role

When creating your custom role in Azure RBAC, add these Actions. You can scope them at Subscription, Resource Group, or individual resource level:

Note

The table above lists built-in roles (like "Website Contributor", "Data Factory Contributor") for convenience. Below are the actual Actions these roles contain. When creating a custom role, you specify Actions, not role names.

Subscription & Resource Group (Base Permissions):

*/read

API Management (equivalent to "API Management Service Contributor"):

Microsoft.ApiManagement/service/*
Microsoft.ApiManagement/service/write
Microsoft.ApiManagement/service/delete

App Services & Function Apps (subset of "Website Contributor"):

Microsoft.Web/sites/read
Microsoft.Web/sites/write
Microsoft.Web/sites/config/list/action
Microsoft.Web/sites/config/read
Microsoft.Web/sites/config/write
Microsoft.Web/sites/webjobs/read
Microsoft.Web/sites/publishingcredentials/read
Microsoft.Web/sites/publishxml/action

Application (subset of "Data Factory Contributor"):

Microsoft.DataFactory/factories/read
Microsoft.DataFactory/factories/write
Microsoft.DataFactory/factories/pipelineruns/read
Microsoft.DataFactory/factories/pipelines/read
Microsoft.DataFactory/factories/pipelines/write

Note: For Application Insights queries, you also need the delegated permission Data.Read configured in API Permissions.

Data Factory:

Microsoft.DataFactory/factories/read
Microsoft.DataFactory/factories/pipelineruns/read
Microsoft.DataFactory/factories/pipelines/read

Event Grid:

Microsoft.EventGrid/eventSubscriptions/read

Event Hubs:

Microsoft.EventHub/namespaces/eventhubs/read
Microsoft.EventHub/namespaces/eventhubs/consumergroups/read
Microsoft.EventHub/namespaces/eventhubs/send/action
Microsoft.EventHub/namespaces/eventhubs/listen/action

Key Vault:

Microsoft.KeyVault/vaults/read
Microsoft.KeyVault/vaults/secrets/read

Note: Also ensure "Azure role-based access control" is enabled in Key Vault's Access configuration.

Logic Apps:

Microsoft.Logic/workflows/read
Microsoft.Logic/workflows/runs/read
Microsoft.Logic/workflows/runs/actions/read
Microsoft.Logic/workflows/triggers/read
Microsoft.Logic/workflows/enable/action
Microsoft.Logic/workflows/disable/action
Microsoft.Logic/workflows/runs/action

Note: Microsoft.Logic/workflows/runs/action is required for resubmitting runs.

Service Bus:

Microsoft.ServiceBus/namespaces/read
Microsoft.ServiceBus/namespaces/queues/read
Microsoft.ServiceBus/namespaces/topics/read
Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action
Microsoft.ServiceBus/namespaces/queues/authorizationRules/listkeys/action

Storage Account (Control Plane - for Storage Account management):

Microsoft.Storage/storageAccounts/read
Microsoft.Storage/storageAccounts/listkeys/action
Microsoft.Storage/storageAccounts/blobServices/read
Microsoft.Storage/storageAccounts/blobServices/containers/read
Microsoft.Storage/storageAccounts/blobServices/containers/write
Microsoft.Storage/storageAccounts/blobServices/containers/delete
Microsoft.Storage/storageAccounts/fileServices/read
Microsoft.Storage/storageAccounts/fileServices/fileshares/read
Microsoft.Storage/storageAccounts/fileServices/fileshares/write
Microsoft.Storage/storageAccounts/queueServices/read
Microsoft.Storage/storageAccounts/queueServices/queues/read
Microsoft.Storage/storageAccounts/queueServices/queues/write
Microsoft.Storage/storageAccounts/queueServices/queues/messages/delete
Microsoft.Storage/storageAccounts/queueServices/queues/messages/add/action

Note: For data operations (reading/writing blobs, files, queue messages), you need data plane roles assigned separately (see section below).

Azure uses two separate permission systems:

  1. Control Plane (RBAC Actions) - Listed above, for managing Azure resources (create, configure, delete)
  2. Data Plane (Data Actions) - Listed below, for accessing data within resources

The custom role created above handles control plane permissions. You must separately assign these data plane roles to access actual data:

Storage Data Plane Roles (assign these separately via IAM):

  • Storage Blob Data Contributor - For blob read/write/delete operations

    • Provides: Read, write, and delete blobs and containers
    • Used by: Azure Monitoring Agent, Logic Apps Agent, Pickup Service

  • Storage Queue Data Reader - For queue read operations

    • Provides: Read and peek queue messages
    • Used by: Azure Monitoring Agent

  • Storage Queue Data Contributor - For queue read/write/delete operations

    • Provides: Read, write, and delete queue messages
    • Used by: Azure Monitoring Agent (if managing queues)

  • Storage File Data SMB Share Reader - For file share read operations

    • Provides: Read files in Azure file shares
    • Used by: Azure Monitoring Agent

  • Storage File Data SMB Share Contributor - For file share read/write/delete operations

    • Provides: Read, write, and delete files in Azure file shares
    • Used by: Azure Monitoring Agent

Event Hubs Data Plane Roles (assign these separately via IAM):

  • Azure Event Hubs Data Sender - Send messages to Event Hubs

    • Used by: Azure Monitoring Agent, Pickup Service

  • Azure Event Hubs Data Receiver - Receive messages from Event Hubs

    • Used by: Logic Apps Agent, Pickup Service

Service Bus Data Plane Roles (assign these separately via IAM):

  • Azure Service Bus Data Owner - Full access to Service Bus queues and topics
    • Provides: Send, receive, and manage messages
    • Used by: Azure Service Bus Monitoring

Important

Data plane roles CANNOT be included in the ARM template because they use a different permission model (dataActions instead of actions). You must assign them separately via the Azure Portal IAM or using PowerShell/CLI after creating the custom role.

  • Event Hubs: Azure Event Hubs Data Sender, Azure Event Hubs Data Receiver
  • Storage Accounts: Storage Blob Data Contributor, Storage Queue Data Reader, Storage File Data SMB Share Contributor
  • Service Bus: Azure Service Bus Data Owner [!IMPORTANT] After creating or updating role assignments, changes may take up to 5 minutes to propagate. Restart the affected Nodinite agents to refresh the cached authentication token, otherwise it may take up to one hour for changes to take effect.

Example: Creating Custom Role via Azure Portal

  1. Navigate to your Subscription or Resource Group
  2. Select Access Control (IAM) → Roles → Add custom role
  3. Enter role name (e.g., "Nodinite Monitoring")
  4. Select Start from scratch or Clone a role
  5. On the Permissions tab, click Add permissions
  6. Search for and add the Actions listed above
  7. Set Assignable scopes (Subscription or Resource Group)
  8. Review and create the role
  9. Assign the role to your App Registration(s)

For more details, see Azure custom roles documentation.

Automated Deployment with ARM Template

For faster and more consistent deployment, use our complete automation solution that deploys both the custom role AND data plane permissions:

Complete Azure Role Deployment Automation

Includes ARM template for custom role creation plus PowerShell/CLI scripts to automate data plane role assignments.

Next Step