1

I am trying to understand the overlap between two of those roles in Azure RBAC. Looks like monitor-contributor completely covers application-insights-component-contributor besides "Microsoft.Resources/deployments/*". Considering the following situation whether I am deploying web availability tests into AppInsights resource and the deployment identity is service principal which was already granted monitor-contributor permissions. Should I grant this identity also 'application-insights-component-contributor' to be able to create those resources or 'monitor contributor' is good enough?

1 Edit

I am also deploying alert rules along with the tests and those rules implemented as rm template, if SP was granted monitoring-contributor only it's fails with

Error: requesting Validation for Template Deployment "app508-dfpg-dev3-diag-eastus2-backoffice-ai-test-dep" (Resource Group "app508-dfpg-ne-diag-eastus2"): resources.DeploymentsClient#Validate: Failure sending request: StatusCode=403 -- Original Error: Code="AuthorizationFailed" Message="The client '2c20abbf-e825-495c-9d06-90c5f04f9c60' with object id '2c20abbf-0000-0000-0000-90c5f04f9c60' does not have authorization to perform action 'Microsoft.Resources/deployments/validate/action' over scope '/subscriptions/s/resourcegroups/app508-dfpg-ne-diag-eastus2/providers/Microsoft.Resources/deployments/app508-dfpg-dev3-diag-eastus2-backoffice-ai-test-dep' or the scope is invalid. If access was recently granted, please refresh your credentials."
Alexey Auslender
  • 402
  • 5
  • 18

1 Answers1

2

No need to give the Application Insights Component Contributor role, Monitoring Contributor role is enough. When you deploying the web availability tests, you just need the Microsoft.Insights/webtests/* action permission, it is already included in Monitoring Contributor.

Joy Wang
  • 39,905
  • 3
  • 30
  • 54
  • Thanks a lot for the quick turnaround, please see my first edit. – Alexey Auslender Dec 04 '20 at 22:19
  • @AlexeyAuslender If you are deploying them with ARM template, you also need `Microsoft.Resources/deployments/validate/action` permission, it is included in the `Application Insights Component Contributor` as `Microsoft.Resources/deployments/*`, not in the `Monitoring Contributor`, so in your case, just also add `Application Insights Component Contributor` will be ok. – Joy Wang Dec 05 '20 at 03:28