Azure built-in roles · analytics

This page's changes and edits · All guidance changes

Microsoft's edit · 25 Feb 2025 21:06 UTC

Data Purger and Log Analytics to Monitor category

Microsoft's commit message in MicrosoftDocs/azure-docs · commit 363428e · +0 ~~−165~~ lines · also on GitHub

⋯ 201 unchanged lines

202202 }

203203 ```

204204

205 −## Data Purger

206 −

207 −Delete private data from a Log Analytics workspace.

208 −

209 −[Learn more](/azure/azure-monitor/logs/personal-data-mgmt)

210 −

211 −> [!div class="mx-tableFixed"]

212 −> | Actions | Description |

213 −> | --- | --- |

214 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/components/*/read | |

215 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/components/purge/action | Purging data from Application Insights |

216 −> | [Microsoft.OperationalInsights](../permissions/monitor.md#microsoftoperationalinsights)/workspaces/*/read | View log analytics data |

217 −> | [Microsoft.OperationalInsights](../permissions/monitor.md#microsoftoperationalinsights)/workspaces/purge/action | Delete specified data by query from workspace. |

218 −> | **NotActions** | |

219 −> | *none* | |

220 −> | **DataActions** | |

221 −> | *none* | |

222 −> | **NotDataActions** | |

223 −> | *none* | |

224 −

225 −```json

226 −{

227 − "assignableScopes": [

228 − "/"

229 − ],

230 − "description": "Can purge analytics data",

231 − "id": "/providers/Microsoft.Authorization/roleDefinitions/150f5e0c-0603-4f03-8c7f-cf70034c4e90",

232 − "name": "150f5e0c-0603-4f03-8c7f-cf70034c4e90",

233 − "permissions": [

234 − {

235 − "actions": [

236 − "Microsoft.Insights/components/*/read",

237 − "Microsoft.Insights/components/purge/action",

238 − "Microsoft.OperationalInsights/workspaces/*/read",

239 − "Microsoft.OperationalInsights/workspaces/purge/action"

240 − ],

241 − "notActions": [],

242 − "dataActions": [],

243 − "notDataActions": []

244 − }

245 − ],

246 − "roleName": "Data Purger",

247 − "roleType": "BuiltInRole",

248 − "type": "Microsoft.Authorization/roleDefinitions"

249 −}

250 −```

251 −

252205 ## HDInsight Cluster Operator

253206

254207 Lets you read and modify HDInsight cluster configurations.

⋯ 299 unchanged lines

554507 }

555508 ],

556509 "roleName": "HDInsight on AKS Cluster Pool Admin",

557 − "roleType": "BuiltInRole",

558 − "type": "Microsoft.Authorization/roleDefinitions"

559 −}

560 −```

561 −

562 −## Log Analytics Contributor

563 −

564 −Log Analytics Contributor can read all monitoring data and edit monitoring settings. Editing monitoring settings includes adding the VM extension to VMs; reading storage account keys to be able to configure collection of logs from Azure Storage; adding solutions; and configuring Azure diagnostics on all Azure resources.

565 −

566 −[!INCLUDE [role-read-permissions.md](../includes/role-read-permissions.md)]

567 −

568 −[Learn more](/azure/azure-monitor/logs/manage-access)

569 −

570 −> [!div class="mx-tableFixed"]

571 −> | Actions | Description |

572 −> | --- | --- |

573 −> | */read | Read control plane information for all Azure resources. |

574 −> | [Microsoft.ClassicCompute](../permissions/compute.md#microsoftclassiccompute)/virtualMachines/extensions/* | |

575 −> | [Microsoft.ClassicStorage](../permissions/storage.md#microsoftclassicstorage)/storageAccounts/listKeys/action | Lists the access keys for the storage accounts. |

576 −> | [Microsoft.Compute](../permissions/compute.md#microsoftcompute)/virtualMachines/extensions/* | |

577 −> | [Microsoft.HybridCompute](../permissions/hybrid-multicloud.md#microsofthybridcompute)/machines/extensions/write | Installs or Updates an Azure Arc extensions |

578 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

579 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/diagnosticSettings/* | Creates, updates, or reads the diagnostic setting for Analysis Server |

580 −> | [Microsoft.OperationalInsights](../permissions/monitor.md#microsoftoperationalinsights)/* | |

581 −> | [Microsoft.OperationsManagement](../permissions/monitor.md#microsoftoperationsmanagement)/* | |

582 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

583 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourcegroups/deployments/* | |

584 −> | [Microsoft.Storage](../permissions/storage.md#microsoftstorage)/storageAccounts/listKeys/action | Returns the access keys for the specified storage account. |

585 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

586 −> | **NotActions** | |

587 −> | *none* | |

588 −> | **DataActions** | |

589 −> | *none* | |

590 −> | **NotDataActions** | |

591 −> | *none* | |

592 −

593 −```json

594 −{

595 − "assignableScopes": [

596 − "/"

597 − ],

598 − "description": "Log Analytics Contributor can read all monitoring data and edit monitoring settings. Editing monitoring settings includes adding the VM extension to VMs; reading storage account keys to be able to configure collection of logs from Azure Storage; adding solutions; and configuring Azure diagnostics on all Azure resources.",

599 − "id": "/providers/Microsoft.Authorization/roleDefinitions/92aaf0da-9dab-42b6-94a3-d43ce8d16293",

600 − "name": "92aaf0da-9dab-42b6-94a3-d43ce8d16293",

601 − "permissions": [

602 − {

603 − "actions": [

604 − "*/read",

605 − "Microsoft.ClassicCompute/virtualMachines/extensions/*",

606 − "Microsoft.ClassicStorage/storageAccounts/listKeys/action",

607 − "Microsoft.Compute/virtualMachines/extensions/*",

608 − "Microsoft.HybridCompute/machines/extensions/write",

609 − "Microsoft.Insights/alertRules/*",

610 − "Microsoft.Insights/diagnosticSettings/*",

611 − "Microsoft.OperationalInsights/*",

612 − "Microsoft.OperationsManagement/*",

613 − "Microsoft.Resources/deployments/*",

614 − "Microsoft.Resources/subscriptions/resourcegroups/deployments/*",

615 − "Microsoft.Storage/storageAccounts/listKeys/action",

616 − "Microsoft.Support/*"

617 − ],

618 − "notActions": [],

619 − "dataActions": [],

620 − "notDataActions": []

621 − }

622 − ],

623 − "roleName": "Log Analytics Contributor",

624 − "roleType": "BuiltInRole",

625 − "type": "Microsoft.Authorization/roleDefinitions"

626 −}

627 −```

628 −

629 −## Log Analytics Reader

630 −

631 −Log Analytics Reader can view and search all monitoring data as well as and view monitoring settings, including viewing the configuration of Azure diagnostics on all Azure resources.

632 −

633 −[!INCLUDE [role-read-permissions.md](../includes/role-read-permissions.md)]

634 −

635 −[Learn more](/azure/azure-monitor/logs/manage-access)

636 −

637 −> [!div class="mx-tableFixed"]

638 −> | Actions | Description |

639 −> | --- | --- |

640 −> | */read | Read control plane information for all Azure resources. |

641 −> | [Microsoft.OperationalInsights](../permissions/monitor.md#microsoftoperationalinsights)/workspaces/analytics/query/action | Search using new engine. |

642 −> | [Microsoft.OperationalInsights](../permissions/monitor.md#microsoftoperationalinsights)/workspaces/search/action | Executes a search query |

643 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

644 −> | **NotActions** | |

645 −> | [Microsoft.OperationalInsights](../permissions/monitor.md#microsoftoperationalinsights)/workspaces/sharedKeys/read | Retrieves the shared keys for the workspace. These keys are used to connect Microsoft Operational Insights agents to the workspace. |

646 −> | **DataActions** | |

647 −> | *none* | |

648 −> | **NotDataActions** | |

649 −> | *none* | |

650 −

651 −```json

652 −{

653 − "assignableScopes": [

654 − "/"

655 − ],

656 − "description": "Log Analytics Reader can view and search all monitoring data as well as and view monitoring settings, including viewing the configuration of Azure diagnostics on all Azure resources.",

657 − "id": "/providers/Microsoft.Authorization/roleDefinitions/73c42c96-874c-492b-b04d-ab87d138a893",

658 − "name": "73c42c96-874c-492b-b04d-ab87d138a893",

659 − "permissions": [

660 − {

661 − "actions": [

662 − "*/read",

663 − "Microsoft.OperationalInsights/workspaces/analytics/query/action",

664 − "Microsoft.OperationalInsights/workspaces/search/action",

665 − "Microsoft.Support/*"

666 − ],

667 − "notActions": [

668 − "Microsoft.OperationalInsights/workspaces/sharedKeys/read"

669 − ],

670 − "dataActions": [],

671 − "notDataActions": []

672 − }

673 − ],

674 − "roleName": "Log Analytics Reader",

675510 "roleType": "BuiltInRole",

676511 "type": "Microsoft.Authorization/roleDefinitions"

677512 }

⋯ 132 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 08:48 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.