Skip to content

Commit 5cb9dc4

Browse files
halkazwinihalkazwini
committed
add flow logs permissions and other tweaks
1 parent c0f8580 commit 5cb9dc4

File tree

1 file changed

+86
-78
lines changed

1 file changed

+86
-78
lines changed

‎articles/network-watcher/required-rbac-permissions.md

Lines changed: 86 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: halkazwini
66
ms.author: halkazwini
77
ms.service: azure-network-watcher
88
ms.topic: concept-article
9-
ms.date: 03/06/2025
9+
ms.date: 05/01/2025
1010

1111
#CustomerIntent: As an Azure administrator, I want to know the required Azure role-based access control (Azure RBAC) permissions to use each of the Network Watcher capabilities, so I can assign them correctly to users using any of those capabilities.
1212
---
@@ -28,31 +28,35 @@ To learn how to check roles assigned to a user for a subscription, see [List Azu
2828
## Network Watcher
2929

3030
> [!div class="mx-tableFixed"]
31-
> | Action | Description |
32-
> | ------------------------------------------------------------------- | -------------------------------------------------------------- |
33-
> | Microsoft.Network/networkWatchers/read | Get a network watcher |
34-
> | Microsoft.Network/networkWatchers/write | Create or update a network watcher |
35-
> | Microsoft.Network/networkWatchers/delete | Delete a network watcher |
31+
> | Action | Description |
32+
> | ---- | ---- |
33+
> | Microsoft.Network/networkWatchers/read | Get a network watcher |
34+
> | Microsoft.Network/networkWatchers/write | Create or update a network watcher |
35+
> | Microsoft.Network/networkWatchers/delete | Delete a network watcher |
3636
3737
## Connection monitor
3838

39-
| Action | Description |
40-
| ------------------------------------------------------------------- | -------------------------------------------------------------- |
41-
| Microsoft.Network/networkWatchers/connectionMonitors/start/action | Start a connection monitor |
42-
| Microsoft.Network/networkWatchers/connectionMonitors/stop/action | Stop a connection monitor |
43-
| Microsoft.Network/networkWatchers/connectionMonitors/query/action | Query a connection monitor |
44-
| Microsoft.Network/networkWatchers/connectionMonitors/read | Get a connection monitor |
45-
| Microsoft.Network/networkWatchers/connectionMonitors/write | Create a connection monitor |
46-
| Microsoft.Network/networkWatchers/connectionMonitors/delete | Delete a connection monitor |
39+
> [!div class="mx-tableFixed"]
40+
> | Action | Description |
41+
> | ---- | ---- |
42+
> | Microsoft.Network/networkWatchers/connectionMonitors/start/action | Start a connection monitor |
43+
> | Microsoft.Network/networkWatchers/connectionMonitors/stop/action | Stop a connection monitor |
44+
> | Microsoft.Network/networkWatchers/connectionMonitors/query/action | Query a connection monitor |
45+
> | Microsoft.Network/networkWatchers/connectionMonitors/read | Get a connection monitor |
46+
> | Microsoft.Network/networkWatchers/connectionMonitors/write | Create a connection monitor |
47+
> | Microsoft.Network/networkWatchers/connectionMonitors/delete | Delete a connection monitor |
4748
4849
## Flow logs
4950

5051
> [!div class="mx-tableFixed"]
51-
> | Action | Description |
52-
> | --------- | -------------------------------------------------------------- |
53-
> | Microsoft.Network/networkWatchers/configureFlowLog/action | Configure a flow Log |
54-
> | Microsoft.Network/networkWatchers/queryFlowLogStatus/action | Query status for a flow log |
55-
> | Microsoft.Network/networkSecurityGroups/write <sup>1</sup> | Creates a network security group or updates an existing network security group |
52+
> | Action | Description |
53+
> | ---- | ---- |
54+
> | Microsoft.Network/networkWatchers/flowLogs/read | Get Flow Log details |
55+
> | Microsoft.Network/networkWatchers/flowLogs/write | Creates a Flow Log |
56+
> | Microsoft.Network/networkWatchers/flowLogs/delete | Deletes a Flow Log |
57+
> | Microsoft.Network/networkWatchers/configureFlowLog/action | Configure a flow Log |
58+
> | Microsoft.Network/networkWatchers/queryFlowLogStatus/action | Query status for a flow log |
59+
> | Microsoft.Network/networkSecurityGroups/write <sup>1</sup> | Creates a network security group or updates an existing network security group |
5660
Microsoft.Storage/storageAccounts/listServiceSas/Action, </br> Microsoft.Storage/storageAccounts/listAccountSas/Action, <br> Microsoft.Storage/storageAccounts/listKeys/Action | Fetch shared access signatures (SAS) enabling [secure access to storage account](../storage/common/storage-sas-overview.md?toc=/azure/network-watcher/toc.json) and write to the storage account |
5761
5862
<sup>1</sup> Only required with NSG flow logs.
@@ -62,27 +66,27 @@ Microsoft.Storage/storageAccounts/listServiceSas/Action, </br> Microsoft.Storage
6266
Since traffic analytics is enabled as part of the flow log resource, the following permissions are required in addition to all the required permissions for [Flow logs](#flow-logs):
6367

6468
> [!div class="mx-tableFixed"]
65-
> | Action | Description |
66-
> | ------------------------------------------------------------------- | -------------------------------------------------------------- |
67-
> | Microsoft.Network/applicationGateways/read | Get an application gateway |
68-
> | Microsoft.Network/connections/read | Get VirtualNetworkGatewayConnection |
69-
> | Microsoft.Network/loadBalancers/read | Get a load balancer definition |
70-
> | Microsoft.Network/localNetworkGateways/read | Get LocalNetworkGateway |
71-
> | Microsoft.Network/networkInterfaces/read | Get a network interface definition |
72-
> | Microsoft.Network/networkSecurityGroups/read | Get a network security group definition |
73-
> | Microsoft.Network/publicIPAddresses/read | Get a public IP address definition |
74-
> | Microsoft.Network/routeTables/read | Get a route table definition |
75-
> | Microsoft.Network/virtualNetworkGateways/read | Get a VirtualNetworkGateway |
76-
> | Microsoft.Network/virtualNetworks/read | Get a virtual network definition |
77-
> | Microsoft.Network/expressRouteCircuits/read | Get an ExpressRouteCircuit |
78-
> | Microsoft.OperationalInsights/workspaces/read | Get an existing workspace |
79-
> | Microsoft.OperationalInsights/workspaces/sharedkeys/action | Retrieve the shared keys for the workspace |
80-
> | Microsoft.Insights/dataCollectionRules/read <sup>1</sup> | Read a data collection rule |
81-
> | Microsoft.Insights/dataCollectionRules/write <sup>1</sup> | Create or update a data collection rule |
82-
> | Microsoft.Insights/dataCollectionRules/delete <sup>1</sup> | Delete a data collection rule |
83-
> | Microsoft.Insights/dataCollectionEndpoints/read <sup>1</sup> | Read a data collection endpoint |
84-
> | Microsoft.Insights/dataCollectionEndpoints/write <sup>1</sup> | Create or update a data collection endpoint |
85-
> | Microsoft.Insights/dataCollectionEndpoints/delete <sup>1</sup> | Delete a data collection endpoint |
69+
> | Action | Description |
70+
> | ---- | ---- |
71+
> | Microsoft.Network/applicationGateways/read | Get an application gateway |
72+
> | Microsoft.Network/connections/read | Get VirtualNetworkGatewayConnection |
73+
> | Microsoft.Network/loadBalancers/read | Get a load balancer definition |
74+
> | Microsoft.Network/localNetworkGateways/read | Get LocalNetworkGateway |
75+
> | Microsoft.Network/networkInterfaces/read | Get a network interface definition |
76+
> | Microsoft.Network/networkSecurityGroups/read | Get a network security group definition |
77+
> | Microsoft.Network/publicIPAddresses/read | Get a public IP address definition |
78+
> | Microsoft.Network/routeTables/read | Get a route table definition |
79+
> | Microsoft.Network/virtualNetworkGateways/read | Get a VirtualNetworkGateway |
80+
> | Microsoft.Network/virtualNetworks/read | Get a virtual network definition |
81+
> | Microsoft.Network/expressRouteCircuits/read | Get an ExpressRouteCircuit |
82+
> | Microsoft.OperationalInsights/workspaces/read | Get an existing workspace |
83+
> | Microsoft.OperationalInsights/workspaces/sharedkeys/action | Retrieve the shared keys for the workspace |
84+
> | Microsoft.Insights/dataCollectionRules/read <sup>1</sup> | Read a data collection rule |
85+
> | Microsoft.Insights/dataCollectionRules/write <sup>1</sup> | Create or update a data collection rule |
86+
> | Microsoft.Insights/dataCollectionRules/delete <sup>1</sup> | Delete a data collection rule |
87+
> | Microsoft.Insights/dataCollectionEndpoints/read <sup>1</sup> | Read a data collection endpoint |
88+
> | Microsoft.Insights/dataCollectionEndpoints/write <sup>1</sup> | Create or update a data collection endpoint |
89+
> | Microsoft.Insights/dataCollectionEndpoints/delete <sup>1</sup> | Delete a data collection endpoint |
8690
8791
<sup>1</sup> Only required when using traffic analytics to analyze virtual network flow logs. For more information, see [Data collection rules in Azure Monitor](/azure/azure-monitor/essentials/data-collection-rule-overview?toc=/azure/network-watcher/toc.json) and [Data collection endpoints in Azure Monitor](/azure/azure-monitor/essentials/data-collection-endpoint-overview?toc=/azure/network-watcher/toc.json).
8892

@@ -93,76 +97,80 @@ Since traffic analytics is enabled as part of the flow log resource, the followi
9397
9498
## Connection troubleshoot
9599

96-
| Action | Description |
97-
| ------------------------------------------------------------------- | -------------------------------------------------------------- |
98-
| Microsoft.Network/networkWatchers/connectivityCheck/action | Initiate a connection troubleshoot test |
99-
| Microsoft.Network/networkWatchers/queryTroubleshootResult/action | Query results of a connection troubleshoot test |
100-
| Microsoft.Network/networkWatchers/troubleshoot/action | Run a connection troubleshoot test |
100+
> [!div class="mx-tableFixed"]
101+
> | Action | Description |
102+
> | ---- | ---- |
103+
> | Microsoft.Network/networkWatchers/connectivityCheck/action | Initiate a connection troubleshoot test |
104+
> | Microsoft.Network/networkWatchers/queryTroubleshootResult/action | Query results of a connection troubleshoot test |
105+
> | Microsoft.Network/networkWatchers/troubleshoot/action | Run a connection troubleshoot test |
101106
102107
## Packet capture
103108

104-
| Action | Description |
105-
| ------------------------------------------------------------------- | -------------------------------------------------------------- |
106-
| Microsoft.Network/networkWatchers/packetCaptures/queryStatus/action | Query the status of a packet capture |
107-
| Microsoft.Network/networkWatchers/packetCaptures/stop/action | Stop a packet capture |
108-
| Microsoft.Network/networkWatchers/packetCaptures/read | Get a packet capture |
109-
| Microsoft.Network/networkWatchers/packetCaptures/write | Create a packet capture |
110-
| Microsoft.Network/networkWatchers/packetCaptures/delete | Delete a packet capture |
111-
| Microsoft.Network/networkWatchers/packetCaptures/queryStatus/read | View the status of a packet capture |
109+
> [!div class="mx-tableFixed"]
110+
> | Action | Description |
111+
> | ---- | ---- |
112+
> | Microsoft.Network/networkWatchers/packetCaptures/queryStatus/action | Query the status of a packet capture |
113+
> | Microsoft.Network/networkWatchers/packetCaptures/stop/action | Stop a packet capture |
114+
> | Microsoft.Network/networkWatchers/packetCaptures/read | Get a packet capture |
115+
> | Microsoft.Network/networkWatchers/packetCaptures/write | Create a packet capture |
116+
> | Microsoft.Network/networkWatchers/packetCaptures/delete | Delete a packet capture |
117+
> | Microsoft.Network/networkWatchers/packetCaptures/queryStatus/read | View the status of a packet capture |
112118
113119
## IP flow verify
114120

115121
> [!div class="mx-tableFixed"]
116-
> | Action | Description |
117-
> | ------------------------------------------------------------------- | -------------------------------------------------------------- |
118-
> | Microsoft.Network/networkWatchers/ipFlowVerify/action | Verify an IP flow |
122+
> | Action | Description |
123+
> | ---- | ---- |
124+
> | Microsoft.Network/networkWatchers/ipFlowVerify/action | Verify an IP flow |
119125
120126
## Next hop
121127

122-
| Action | Description |
123-
| ------------------------------------------------------------------- | -------------------------------------------------------------- |
124-
| Microsoft.Network/networkWatchers/nextHop/action, <br> Microsoft.Network/networkWatchers/nextHop/read | For a specified target and destination IP address, return the next hop type and next hope IP address |
125-
| Microsoft.Compute/virtualMachines/read | Get the properties of a virtual machine |
126-
| Microsoft.Network/networkInterfaces/read | Get a network interface definition |
128+
> [!div class="mx-tableFixed"]
129+
> | Action | Description |
130+
> | ---- | ---- |
131+
> | Microsoft.Network/networkWatchers/nextHop/action, <br> Microsoft.Network/networkWatchers/nextHop/read | For a specified target and destination IP address, return the next hop type and next hope IP address |
132+
> | Microsoft.Compute/virtualMachines/read | Get the properties of a virtual machine |
133+
> | Microsoft.Network/networkInterfaces/read | Get a network interface definition |
127134
128135
## Network security group view
129136

130137
> [!div class="mx-tableFixed"]
131-
> | Action | Description |
132-
> | ------------------------------------------------------------------- | -------------------------------------------------------------- |
133-
> | Microsoft.Network/networkWatchers/securityGroupView/action | View security groups |
138+
> | Action | Description |
139+
> | ---- | ---- |
140+
> | Microsoft.Network/networkWatchers/securityGroupView/action | View security groups |
134141
135142
## Topology
136143

137144
> [!div class="mx-tableFixed"]
138-
> | Action | Description |
139-
> | ------------------------------------------------------------------- | -------------------------------------------------------------- |
140-
> | Microsoft.Network/networkWatchers/topology/action | Get topology |
141-
> | Microsoft.Network/networkWatchers/topology/read | Get topology |
145+
> | Action | Description |
146+
> | ---- | ---- |
147+
> | Microsoft.Network/networkWatchers/topology/action | Get topology |
148+
> | Microsoft.Network/networkWatchers/topology/read | Get topology |
142149
143150
## Reachability report
144151

145-
| Action | Description |
146-
| ------------------------------------------------------------------- | -------------------------------------------------------------- |
147-
| Microsoft.Network/networkWatchers/azureReachabilityReport/action | Get an Azure reachability report |
152+
> [!div class="mx-tableFixed"]
153+
> | Action | Description |
154+
> | ---- | ---- |
155+
> | Microsoft.Network/networkWatchers/azureReachabilityReport/action | Get an Azure reachability report |
148156
149157
## Additional actions
150158

151159
Network Watcher capabilities also require the following actions:
152160

153161
> [!div class="mx-tableFixed"]
154-
> | Action(s) | Description |
155-
> | ------------------------------------------------------------------- | -------------------------------------------------------------- |
156-
> | Microsoft.Authorization/\*/Read | Fetch Azure role assignments and policy definitions |
157-
> | Microsoft.Resources/subscriptions/resourceGroups/Read | Enumerate all the resource groups in a subscription |
158-
> | Microsoft.Storage/storageAccounts/Read | Get the properties for the specified storage account |
162+
> | Action | Description |
163+
> | ---- | ---- |
164+
> | Microsoft.Authorization/\*/Read | Fetch Azure role assignments and policy definitions |
165+
> | Microsoft.Resources/subscriptions/resourceGroups/Read | Enumerate all the resource groups in a subscription |
166+
> | Microsoft.Storage/storageAccounts/Read | Get the properties for the specified storage account |
159167
> | Microsoft.Storage/storageAccounts/listServiceSas/Action, </br> Microsoft.Storage/storageAccounts/listAccountSas/Action, <br> Microsoft.Storage/storageAccounts/listKeys/Action | Fetch shared access signatures (SAS) enabling [secure access to storage account](../storage/common/storage-sas-overview.md?toc=/azure/network-watcher/toc.json) and write to the storage account |
160168
> | Microsoft.Compute/virtualMachines/Read, </br> Microsoft.Compute/virtualMachines/Write| Log in to the VM, do a packet capture and upload it to storage account |
161169
> | Microsoft.Compute/virtualMachines/extensions/Read, </br> Microsoft.Compute/virtualMachines/extensions/Write | Check if Network Watcher extension is present, and install if necessary |
162170
> | Microsoft.Compute/virtualMachineScaleSets/Read, </br> Microsoft.Compute/virtualMachineScaleSets/Write | Access virtual machine scale sets, do packet captures and upload them to storage account |
163171
> | Microsoft.Compute/virtualMachineScaleSets/extensions/Read, </br> Microsoft.Compute/virtualMachineScaleSets/extensions/Write| Check if Network Watcher extension is present, and install if necessary |
164-
> | Microsoft.Insights/alertRules/* | Set up metric alerts |
165-
> | Microsoft.Support/* | Create and update support tickets from Network Watcher |
172+
> | Microsoft.Insights/alertRules/* | Set up metric alerts |
173+
> | Microsoft.Support/* | Create and update support tickets from Network Watcher |
166174
167175
## Related content
168176

0 commit comments

Comments
 (0)