Least-Privilege Policies

Cloudaware’s Azure integration is designed to run with read‑only access wherever possible. Use the patterns below to grant only the minimum rights required for each scenario.

See also: Cloudaware Azure Permissions And Roles for a consolidated view of RBAC roles, Graph permissions, and example custom role JSON.

Identity Model

• Use a dedicated app registration (service principal) for Cloudaware (for example, cloudaware-api-access).
• Prefer a single app per Azure AD tenant rather than per subscription.
• Scope all role assignments to management groups, subscriptions, or resource groups that should be visible in Cloudaware.

Baseline Discovery Access (Required)

These permissions are required for inventory, configuration, and relationships across most Azure services.

• Scope:
  • Tenant‑wide: assign at the Tenant Root Management Group to automatically onboard all subscriptions, or
  • Selected subscriptions: assign to each subscription you want Cloudaware to monitor.
• Role:
  • Reader at the chosen scope.
• Effect:
  • Enables read‑only access to Azure Resource Manager for compute, storage, networking, databases, security, and management resources.
  • Does not allow changes to resources.

Directory & Graph Permissions

The app registration that Cloudaware uses should have:

• Azure Service Management:
  • Delegated permission: user_impersonation.
• Microsoft Graph:
  • Application permission: Directory.Read.All.
  • Delegated permission: Directory.Read.All.

note

Higher‑privilege Graph permissions such as Directory.ReadWrite.All are not required. This permission grants read access to all directory objects and enables Cloudaware to collect the full set of Microsoft Entra ID (Azure AD) directory data (users, groups, devices, applications, service principals, etc.).

If you want Cloudaware to collect only users and devices, replace Directory.Read.All with these application permissions instead:

• User.Read.All
• Device.Read.All

After adding the permissions, grant admin consent for the directory so they become effective.

Optional Extended Permissions by Feature

Enable the following only if you plan to use the corresponding Cloudaware features.

Storage Account Keys and VM Extensions

Required for collecting VHD metadata and installing or maintaining Breeze Agent via VM extensions.

• Add a custom role with at minimum:
  • Microsoft.Storage/storageAccounts/listKeys/action
  • Microsoft.Compute/virtualMachines/extensions/write (only if you use Breeze Agent deployment from Cloudaware).

Example custom role JSON scoped to a subscription:

{
  "IsCustom": true,
  "Name": "CloudAware Collector Extended",
  "Description": "Adds access to storage account keys and VM extensions for Cloudaware to collect data about Blob Containers and VHDs",
  "Actions": [
    "Microsoft.Storage/storageAccounts/listKeys/action",
    "Microsoft.Compute/virtualMachines/extensions/write"
  ],
  "notActions": [],
  "assignableScopes": [
    "/subscriptions/{subscription_id}"
  ]
}

Replace {subscription_id} with your Azure subscription ID. Assign this role to the Cloudaware service principal at the subscription scope where the extra capabilities are required.

Key Vault Metadata

To read metadata (not secret values) for keys, secrets, and certificates:

• Keep Reader at subscription level.
• On each Key Vault, add an access policy for the Cloudaware app with:
  • Key permissions: List
  • Secret permissions: List
  • Certificate permissions: List

Cloudaware uses this only to inventory Key Vault objects and expiration dates; it does not retrieve secret values.

Azure Reservations

To inventory Azure Reservations:

• Assign the built‑in Reservations Reader role to the Cloudaware service principal at the reservation scope.

Azure Kubernetes Service (AKS)

To enrich AKS data with cluster user credentials and Kubernetes objects:

• At each onboarded subscription, assign:
  • Built‑in role: Azure Kubernetes Service Cluster User Role, or
  • A custom role that includes Microsoft.ContainerService/managedClusters/listClusterUserCredential/action.

note

For Active Directory–managed clusters, also configure cluster role bindings as described in the AKS Cluster Access guide.

Microsoft Intune–Managed Devices

To collect Azure AD devices managed by Intune:

• In the app registration, add Microsoft Graph application permissions:
  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementConfiguration.Read.All
• Grant admin consent for the tenant.

App Service Configuration Settings

To read App Service configuration (Config: App Settings field):

• Prefer a custom role that includes Microsoft.Web/sites/config/list/action, or
• Assign the built‑in Website Contributor role if your policies allow broader rights.

Example custom role JSON scoped to a subscription:

{
    "properties": {
        "roleName": "Cloudaware Custom Policy",
        "description": "{custom-role-description}",
        "assignableScopes": [
            "/subscriptions/{subscription-id}"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Web/sites/config/list/Action",
                    "Microsoft.Web/sites/Read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Replace {custom-role-description} and {subscription-id} with appropriate values.

Tagging from Cloudaware

To allow Cloudaware Tag Analyzer and other workflows to update tags in Azure:

• Assign the built‑in Tag Contributor role, or
• Create a custom role that grants Microsoft.Resources/tags/* for the required scope.

Example custom role JSON scoped to a subscription:

"properties": {
        "roleName": "Cloudaware Custom Policy",
        "description": "{custom-role-description}",
        "assignableScopes": [
            "/subscriptions/{subscription-id}",
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Resources/subscriptions/tagNames/read",
                    "Microsoft.Resources/subscriptions/tagNames/write",
                    "Microsoft.Resources/subscriptions/tagNames/delete",
                    "Microsoft.Resources/subscriptions/tagNames/tagValues/read",
                    "Microsoft.Resources/subscriptions/tagNames/tagValues/write",
                    "Microsoft.Resources/subscriptions/tagNames/tagValues/delete",
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                    "Microsoft.Resources/tags/write",
                    "Microsoft.Resources/tags/delete",
                    "Microsoft.Resources/tags/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }

Replace {custom-role-description} and {subscription-id} with appropriate values.

Limit tagging permissions to subscriptions or resource groups where tag changes from Cloudaware are expected.

To learn how to work with tags in Cloudaware, see Cloudaware Tag Analyzer.

Scoping Recommendations

• Use management‑group assignments for large organizations; use subscription‑level assignments for tighter boundaries.
• Avoid assigning broad write roles (such as Contributor) to the Cloudaware app.
• Review role assignments regularly and remove features you do not use to keep the privilege footprint small.