Merge pull request #301243 from halkazwini/nw-rbac

Network Watcher RBAC update (CSS feedback)

Author: Stacyrch140

articles/network-watcher/required-rbac-permissions.md

@@ -6,7 +6,7 @@ author: halkazwini
 ms.author: halkazwini
 ms.service: azure-network-watcher
 ms.topic: concept-article
-ms.date: 06/11/2025
+ms.date: 06/12/2025
 
 #CustomerIntent: As an Azure administrator, I want to know the required Azure role-based access control (Azure RBAC) permissions to use each of the Network Watcher capabilities, so I can assign them correctly to users using any of those capabilities.
 ---
@@ -25,7 +25,7 @@ To use Azure Network Watcher capabilities, the account you log into Azure with,
 
 To learn how to check roles assigned to a user for a subscription, see [List Azure role assignments using the Azure portal](../role-based-access-control/role-assignments-list-portal.yml?toc=/azure/network-watcher/toc.json). If you can't see the role assignments, contact the respective subscription admin.
 
-The following sections list the minimum required permissions to use Network Watcher and its capabilities. For a full list of related Azure permissions, see [Microsoft.Network permissions](/azure/role-based-access-control/permissions/networking#microsoftnetwork), [Microsoft.Compute permissions](/azure/role-based-access-control/permissions/compute#microsoftcompute), [Microsoft.Storage permissions](/azure/role-based-access-control/permissions/storage#microsoftstorage), [Microsoft.Insights permissions](/azure/role-based-access-control/permissions/monitor#microsoftinsights), and [Microsoft.OperationalInsights permissions](/azure/role-based-access-control/permissions/monitor#microsoftoperationalinsights).
+The following sections list the minimum required permissions to use Network Watcher and its capabilities. For a full list of related Azure permissions, see [Microsoft.Network permissions](/azure/role-based-access-control/permissions/networking?toc=/azure/network-watcher/toc.json#microsoftnetwork), [Microsoft.Compute permissions](/azure/role-based-access-control/permissions/compute?toc=/azure/network-watcher/toc.json#microsoftcompute), [Microsoft.Storage permissions](/azure/role-based-access-control/permissions/storage?toc=/azure/network-watcher/toc.json#microsoftstorage), [Microsoft.Insights permissions](/azure/role-based-access-control/permissions/monitor?toc=/azure/network-watcher/toc.json#microsoftinsights), and [Microsoft.OperationalInsights permissions](/azure/role-based-access-control/permissions/monitor?toc=/azure/network-watcher/toc.json#microsoftoperationalinsights).
 
 ## Network Watcher
 
@@ -90,7 +90,7 @@ Since traffic analytics is enabled as part of the flow log resource, the followi
 > | Microsoft.Insights/dataCollectionEndpoints/write <sup>1</sup> | Create or update a data collection endpoint |
 > | Microsoft.Insights/dataCollectionEndpoints/delete <sup>1</sup> | Delete a data collection endpoint |
 
-<sup>1</sup> Only required when using traffic analytics to analyze virtual network flow logs. For more information, see [Data collection rules in Azure Monitor](/azure/azure-monitor/essentials/data-collection-rule-overview?toc=/azure/network-watcher/toc.json) and [Data collection endpoints in Azure Monitor](/azure/azure-monitor/essentials/data-collection-endpoint-overview?toc=/azure/network-watcher/toc.json).
+<sup>1</sup> Required on the Log Analytics workspace subscription when using traffic analytics with virtual network flow logs.
 
 [!INCLUDE [Traffic analytics resources](../../includes/network-watcher-traffic-analytics-resources.md)]
 

includes/network-watcher-traffic-analytics-resources.md

@@ -3,8 +3,8 @@ author: halkazwini
 ms.author: halkazwini
 ms.service: azure-network-watcher
 ms.topic: include
-ms.date: 04/17/2025    
+ms.date: 06/12/2025    
 ms.custom: include file
 ---
 > [!CAUTION]
-> Traffic analytics creates and manages data collection rule and data collection endpoint resources in the same resource group as the workspace, prefixed with `NWTA`. If you perform any operation on these resources, traffic analytics might not function as expected.
+> Traffic analytics creates and manages [data collection rule (DCR)](/azure/azure-monitor/essentials/data-collection-rule-overview?toc=/azure/network-watcher/toc.json) and [data collection endpoint (DCE)](/azure/azure-monitor/essentials/data-collection-endpoint-overview?toc=/azure/network-watcher/toc.json) resources in the same resource group as the Log Analytics workspace, prefixed with `NWTA`. If you perform any operation on these resources, traffic analytics might not function as expected.