Update faq-permissions.yml

Added permissions for agentless scanning CMK support

Author: moraviv

articles/defender-for-cloud/faq-permissions.yml

@@ -40,12 +40,19 @@ sections:
 
             - `Microsoft.Compute/disks/read`
             - `Microsoft.Compute/disks/beginGetAccess/action`
+            - `Microsoft.Compute/disks/diskEncryptionSets/read`
             - `Microsoft.Compute/virtualMachines/instanceView/read`
             - `Microsoft.Compute/virtualMachines/read`
             - `Microsoft.Compute/virtualMachineScaleSets/instanceView/read`
             - `Microsoft.Compute/virtualMachineScaleSets/read`
             - `Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read`
             - `Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read`
+            
+            When coverage for CMK encrypted disks is enabled, these additional permissions are used: 
+            - `Microsoft.KeyVault/vaults/keys/read`
+            - `Microsoft.KeyVault/vaults/keys/wrap/action`
+            - `Microsoft.KeyVault/vaults/keys/unwrap/action`
+
 
           - AWS permissions - The role “VmScanner” is assigned to the scanner when you enable agentless scanning. This role has the minimal permission set to create and clean up snapshots (scoped by tag) and to verify the current state of the VM. The detailed permissions are:
 
@@ -104,4 +111,4 @@ sections:
       - question: |
           What is the minimum SAS policy permissions required when exporting data to Azure Event Hubs?
         answer: |
-          **Send** is the minimum SAS policy permissions required. For step-by-step instructions, see **Step 1: Create an Event Hubs namespace and event hub with send permissions** in [this article](./export-to-splunk-or-qradar.md#step-1-create-an-event-hubs-namespace-and-event-hub-with-send-permissions).
+          **Send** is the minimum SAS policy permissions required. For step-by-step instructions, see **Step 1: Create an Event Hubs namespace and event hub with send permissions** in [this article](./export-to-splunk-or-qradar.md#step-1-create-an-event-hubs-namespace-and-event-hub-with-send-permissions).