azureblog.co.uk
← cd ~/roles
// roles/azure · monitor

Log Analytics ReaderAzure built-in role

Log Analytics Reader can view and search all monitoring data as well as and view monitoring settings, including viewing the configuration of Azure diagnostics on all Azure resources.

Role ID73c42c96-874c-492b-b04d-ab87d138a893
CategoryMonitor
Actions4 (minus 1 NotActions)
Data actions1

Before you assign it

  • It reaches the data, not just the resource. It has 1 data action, such as reading blobs, secrets or messages.

What it can do

PermissionWhat it allows
*/readEvery operation matching */read
Microsoft.OperationalInsights/workspaces/analytics/query/actionSearch using new engine.
Microsoft.OperationalInsights/workspaces/search/actionExecutes a search query
Microsoft.Support/*Every operation under Microsoft.Support

Can't do

These are taken away from the actions above.

PermissionWhat it allows
Microsoft.OperationalInsights/workspaces/sharedKeys/readRetrieves the shared keys for the workspace. These keys are used to connect Microsoft Operational Insights agents to the workspace.

Data actions

PermissionWhat it allows
Microsoft.OperationalInsights/workspaces/jobs/export/actionLets you export data from Log Analytics workspace per query and time range

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli
az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Log Analytics Reader" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
powershell3 lines
New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Log Analytics Reader" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"
bicep7 lines
resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '73c42c96-874c-492b-b04d-ab87d138a893')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph
authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "73c42c96-874c-492b-b04d-ab87d138a893"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other monitor roles

Find the smallest role for a task →

Sources