Azure Permissions

Azure access spans Resource Manager provider actions and Microsoft Graph application permissions. Every scope is read only.

Ventra collectors need read only access across 15 service areas. Each area maps to one or more collectors in Acquire, and the full action list lives in the downloadable policy files below.

• Subscription (1 actions)
• Resource graph (1 actions)
• Activity log (2 actions)
• Diagnostic settings (2 actions)
• NSG and VNet flow (4 actions)
• Azure Firewall (3 actions)
• Application Gateway (3 actions)
• Front Door (4 actions)
• DNS (5 actions)
• Storage access (3 actions)
• Key Vault (3 actions)
• AKS audit (3 actions)
• Defender (2 actions)
• RBAC (2 actions)
• Microsoft Graph (5 actions)

Diagnostic settings posture records whether a resource sends logs to Storage, Log Analytics, or Event Hub. Ventra reads the blobs in Storage. A Log Analytics-only route is recorded as a gap; there is no Log Analytics collector.

To read diagnostic and flow log blobs from storage accounts, grant Storage Blob Data Reader or an equivalent data action on the accounts that hold the logs.