← cd ~/compare
// compare · azure roles
Reader vs Monitoring Reader
Two Azure built-in roles that are often confused, compared permission by permission.
In short: Reader has 1 actions. Monitoring Reader has 3 actions. Assign the one with less access that still covers the job.
| Detail | Reader | Monitoring Reader |
|---|---|---|
| What Microsoft says | View all resources, but does not allow you to make any changes. | Can read all monitoring data. |
| Size | 1 actions | 3 actions |
Permissions only Reader lists (0)
None.
Permissions only Monitoring Reader lists (2)
Microsoft.OperationalInsights/workspaces/search/actionMicrosoft.Support/*
Azure roles use wildcards such as *, and NotActions take permissions away, so a role can cover an action without listing it. Check the role pages for the full picture.
Spotted something out of date or wrong? Tell us and we'll fix it.