// roles/azure · monitor

Monitoring Policy ContributorAzure built-in role

Allows read access to all monitoring data, update permissions for monitoring settings and permissions to deploy and remediate Azure Monitor alert policies.

Role ID	`47be4a87-7950-4631-9daf-b664a405f074`
Category	Monitor
Actions	47
Data actions	0

What it can do

Permission	What it allows
`*/read`	Every operation matching */read
`Microsoft.AlertsManagement/alerts/*`	Every operation under Microsoft.AlertsManagement/alerts
`Microsoft.AlertsManagement/alertsSummary/*`	Every operation under Microsoft.AlertsManagement/alertsSummary
`Microsoft.AlertsManagement/issues/*`	Every operation under Microsoft.AlertsManagement/issues
`Microsoft.Insights/actiongroups/*`	Every operation under Microsoft.Insights/actiongroups
`Microsoft.Insights/activityLogAlerts/*`	Every operation under Microsoft.Insights/activityLogAlerts
`Microsoft.Insights/AlertRules/*`	Every operation under Microsoft.Insights/AlertRules
`Microsoft.Insights/components/*`	Every operation under Microsoft.Insights/components
`Microsoft.Insights/createNotifications/*`	Every operation under Microsoft.Insights/createNotifications
`Microsoft.Insights/dataCollectionEndpoints/*`	Every operation under Microsoft.Insights/dataCollectionEndpoints
`Microsoft.Insights/dataCollectionRules/*`	Every operation under Microsoft.Insights/dataCollectionRules
`Microsoft.Insights/dataCollectionRuleAssociations/*`	Every operation under Microsoft.Insights/dataCollectionRuleAssociations
`Microsoft.Insights/DiagnosticSettings/*`	Every operation under Microsoft.Insights/DiagnosticSettings
`Microsoft.Insights/eventtypes/*`	Every operation under Microsoft.Insights/eventtypes
`Microsoft.Insights/LogDefinitions/*`	Every operation under Microsoft.Insights/LogDefinitions
`Microsoft.Insights/metricalerts/*`	Every operation under Microsoft.Insights/metricalerts
`Microsoft.Insights/MetricDefinitions/*`	Every operation under Microsoft.Insights/MetricDefinitions
`Microsoft.Insights/Metrics/*`	Every operation under Microsoft.Insights/Metrics
`Microsoft.Insights/notificationStatus/*`	Every operation under Microsoft.Insights/notificationStatus
`Microsoft.Insights/Register/Action`	Register the Microsoft Insights provider
`Microsoft.Insights/scheduledqueryrules/*`	Every operation under Microsoft.Insights/scheduledqueryrules
`Microsoft.Insights/webtests/*`	Every operation under Microsoft.Insights/webtests
`Microsoft.Insights/workbooks/*`	Every operation under Microsoft.Insights/workbooks
`Microsoft.Insights/workbooktemplates/*`	Every operation under Microsoft.Insights/workbooktemplates
`Microsoft.Insights/privateLinkScopes/*`	Every operation under Microsoft.Insights/privateLinkScopes
`Microsoft.Insights/privateLinkScopeOperationStatuses/*`	Every operation under Microsoft.Insights/privateLinkScopeOperationStatuses
`Microsoft.Monitor/accounts/*`	Every operation under Microsoft.Monitor/accounts
`Microsoft.OperationalInsights/workspaces/write`	Creates a new workspace or links to an existing workspace by providing the customer id from the existing workspace.
`Microsoft.OperationalInsights/workspaces/intelligencepacks/*`	Every operation under Microsoft.OperationalInsights/workspaces/intelligencepacks
`Microsoft.OperationalInsights/workspaces/savedSearches/*`	Every operation under Microsoft.OperationalInsights/workspaces/savedSearches
`Microsoft.OperationalInsights/workspaces/search/action`	Executes a search query
`Microsoft.OperationalInsights/workspaces/sharedKeys/action`	Retrieves the shared keys for the workspace. These keys are used to connect Microsoft Operational Insights agents to the workspace.
`Microsoft.OperationalInsights/workspaces/sharedKeys/read`	Retrieves the shared keys for the workspace. These keys are used to connect Microsoft Operational Insights agents to the workspace.
`Microsoft.OperationalInsights/workspaces/storageinsightconfigs/*`	Every operation under Microsoft.OperationalInsights/workspaces/storageinsightconfigs
`Microsoft.OperationalInsights/locations/workspaces/failover/action`	Initiates workspace failover to replication location.
`Microsoft.OperationalInsights/workspaces/failback/action`	Initiates workspace failback.
`Microsoft.Support/*`	Every operation under Microsoft.Support
`Microsoft.AlertsManagement/smartDetectorAlertRules/*`	Every operation under Microsoft.AlertsManagement/smartDetectorAlertRules
`Microsoft.AlertsManagement/actionRules/*`	Every operation under Microsoft.AlertsManagement/actionRules
`Microsoft.AlertsManagement/smartGroups/*`	Every operation under Microsoft.AlertsManagement/smartGroups
`Microsoft.AlertsManagement/migrateFromSmartDetection/*`	Every operation under Microsoft.AlertsManagement/migrateFromSmartDetection
`Microsoft.AlertsManagement/investigations/*`	Every operation under Microsoft.AlertsManagement/investigations
`Microsoft.AlertsManagement/prometheusRuleGroups/*`	Every operation under Microsoft.AlertsManagement/prometheusRuleGroups
`Microsoft.Monitor/investigations/*`	Every operation under Microsoft.Monitor/investigations
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.PolicyInsights/remediations/*`	Every operation under Microsoft.PolicyInsights/remediations
`Microsoft.Resources/subscriptions/resourceGroups/*`	Every operation under Microsoft.Resources/subscriptions/resourceGroups

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Monitoring Policy Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Monitoring Policy Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '47be4a87-7950-4631-9daf-b664a405f074')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '47be4a87-7950-4631-9daf-b664a405f074')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "47be4a87-7950-4631-9daf-b664a405f074"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other monitor roles

Grafana Admin · 1 permission
Grafana Editor · 1 permission
Grafana Limited Viewer · 1 permission
Grafana Viewer · 1 permission
Log Analytics Data Reader · 3 permissions
Monitoring Reader · 3 permissions
Workbook Reader · 3 permissions
Data Purger · 4 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles