Azure permissions

The set of Azure permissions that is required by R‑Cloud and must be included in the Azure IAM role that is assigned to the HMSP depends on whether the Azure resource group is added to R‑Cloud as compute or a source. Some permissions are common to both scenarios, while others are specific to a particular scenario:

Permission	Action
Compute	Required when adding compute or a source: disks/delete virtualMachines/delete virtualMachines/deallocate/action virtualMachines/read virtualMachines/start/action virtualMachines/write Additionally required when adding a source: disks/beginGetAccess/action disks/endGetAccess/action disks/read disks/write galleries/images/versions/read snapshots/beginGetAccess/action snapshots/delete snapshots/endGetAccess/action snapshots/read snapshots/write virtualMachines/attachDetachDataDisks/action virtualMachines/instanceView/read virtualMachines/retrieveBootDiagnosticsData/action
Key Vault (required only when adding a source)	vaults/keys/encrypt/action vaults/keys/decrypt/action
Network	Required when adding compute or a source: networkInterfaces/delete networkInterfaces/join/action networkInterfaces/read publicIPAddresses/delete publicIPAddresses/join/action publicIPAddresses/write virtualNetworks/read virtualNetworks/subnets/join/action virtualNetworks/subnets/read
Resource	Required when adding compute or a source: subscriptions/read subscriptions/resourceGroups/read
Storage (required only when adding a source)	storageAccounts/blobServices/ storageAccounts/blobServices/containers/ storageAccounts/blobServices/containers/blobs/* storageAccounts/blobServices/containers/blobs/tags/read storageAccounts/blobServices/containers/blobs/tags/write storageAccounts/blobServices/generateUserDelegationKey/action storageAccounts/delete storageAccounts/listKeys/action storageAccounts/managementPolicies/read storageAccounts/read storageAccounts/write

Additionally, you must grant the following permissions to the Azure IAM role that is assigned to the HMSP or the custom service principal for performing operations on the target that you set up for storing data:

Permission	Action
Key Vault	vaults/keys/encrypt/action vaults/keys/decrypt/action
Storage	storageAccounts/blobServices/* storageAccounts/blobServices/containers/* storageAccounts/blobServices/containers/blobs/* storageAccounts/blobServices/containers/blobs/tags/write storageAccounts/blobServices/containers/blobs/tags/read storageAccounts/blobServices/generateUserDelegationKey/action storageAccounts/managementPolicies/read