← cd ~/compare
// compare · azure roles
Log Analytics Contributor vs Log Analytics Reader
Two Azure built-in roles that are often confused, compared permission by permission.
In short: Log Analytics Contributor has 13 actions, 1 data actions. Log Analytics Reader has 4 actions, 1 NotActions, 1 data actions. Assign the one with less access that still covers the job.
| Detail | Log Analytics Contributor | Log Analytics Reader |
|---|---|---|
| What Microsoft says | Log Analytics Contributor can read all monitoring data and edit monitoring settings. Editing monitoring settings includes adding the VM extension to VMs; reading storage account keys to be able to configure collection of logs from Azure Storage; adding solutions; and configuring Azure diagnostics on all Azure resources. | Log Analytics Reader can view and search all monitoring data as well as and view monitoring settings, including viewing the configuration of Azure diagnostics on all Azure resources. |
| Size | 13 actions, 1 data actions | 4 actions, 1 NotActions, 1 data actions |
Permissions only Log Analytics Contributor lists (11)
Microsoft.ClassicCompute/virtualMachines/extensions/*Microsoft.ClassicStorage/storageAccounts/listKeys/actionMicrosoft.Compute/virtualMachines/extensions/*Microsoft.HybridCompute/machines/extensions/writeMicrosoft.Insights/alertRules/*Microsoft.Insights/diagnosticSettings/*Microsoft.OperationalInsights/*Microsoft.OperationsManagement/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourcegroups/deployments/*Microsoft.Storage/storageAccounts/listKeys/action
Permissions only Log Analytics Reader lists (2)
Microsoft.OperationalInsights/workspaces/analytics/query/actionMicrosoft.OperationalInsights/workspaces/search/action
Azure roles use wildcards such as *, and NotActions take permissions away, so a role can cover an action without listing it. Check the role pages for the full picture.
Log Analytics Contributor explained Log Analytics Reader explained
Spotted something out of date or wrong? Tell us and we'll fix it.