Below you will find the necessary permissions for the Azure custom integration drivers that we offer. You will see the required permissions, followed by a JSON example of the least privileged permissions required.
Azure Containers
Azure Containers Monitoring Script Description
1. Title: Azure Containers. Subtitle: azure.
2. Description: Monitor Azure Containers. This script retrieves information about Containers.
3. Labels: "container" and "container-group" indicate categories associated with the script.
4. Action: "Use Driver" button initiates the script to monitor Azure Containers.
5. Additional Options: The three-dot menu button provides more options or settings related to the script.
Minimal RBAC actions the app (service principal) must have on the target scope (subscription or specific resource groups):
- Microsoft.ContainerInstance/containerGroups/read — list/read container groups.
- Microsoft.Insights/metrics/read — read metrics for each container group.
Built-in role equivalents (either works):
- Reader (broad read to the scope) or Monitoring Reader (read all monitoring data). Assign to the subscription or RG that holds the ACI groups.
Example custom role JSON (least-privilege):
{
"Name": "Domotz - Azure Containers Read (Least Privilege)",
"IsCustom": true,
"Description": "Allows listing Azure Container Instance groups and reading their metrics for Domotz monitoring.",
"Actions": [
"Microsoft.ContainerInstance/containerGroups/read",
"Microsoft.Insights/metrics/read",
"Microsoft.Insights/metricDefinitions/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/<SUBSCRIPTION_ID>"
// or narrow to specific RGs:
// "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>"
]
}Azure Daily Billing Costs
Azure Daily Billing Costs Overview
1. The title "Azure Daily Billing Costs" is displayed at the top, specifying the script's purpose.
2. The description explains that the script retrieves Azure billing data for the previous day's costs and usage, categorized by key dimensions.
3. Two tags, "billing" and "cost," categorize the information provided by the script.
4. A "Use Driver" button allows users to initiate or apply the script.
5. An additional options menu, represented by three dots, provides access to more actions or settings related to the script.
Minimal RBAC actions the app (service principal) needs at the subscription scope you’re querying:
- Microsoft.CostManagement/query/action
Built-in role equivalents
- Cost Management Reader (assign at the subscription).
Example custom role JSON (least-privilege):
{
"Name": "Domotz - Azure Cost Query (Least Privilege)",
"IsCustom": true,
"Description": "Allows running Cost Management Query at subscription scope for Domotz daily billing driver.",
"Actions": [
"Microsoft.CostManagement/query/action"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/<SUBSCRIPTION_ID>"
]
}You can scope the role to specific management groups or subscriptions as needed.
Azure Disks Information
Azure Disks Information Interface
1. The interface displays the title "Azure Disks Information" and the label "azure."
2. A description states that the script monitors Azure Compute Disks and retrieves information about disks.
3. Two tags labeled "compute" and "disk" are shown, indicating categorization.
4. Two options are available: "Use Driver" button and a three-dot menu for additional settings or actions.
Grant the app (service principal) these RBAC actions at the subscription (or specific RGs that hold the disks):
- Microsoft.Compute/disks/read — list/read disk resources
- Microsoft.Insights/metrics/read — read disk metrics
Built-in roles that work
- Reader (broad read at scope), or
- Monitoring Reader (read all monitoring data)
Example custom role JSON (least privilege):
{
"Name": "Domotz - Azure Disks Read (Least Privilege)",
"IsCustom": true,
"Description": "Allows listing Azure Compute Disks and reading their metrics for Domotz monitoring.",
"Actions": [
"Microsoft.Compute/disks/read",
"Microsoft.Insights/metrics/read",
"Microsoft.Insights/metricDefinitions/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/<SUBSCRIPTION_ID>"
// or narrow to specific RGs:
// "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>"
]
}Scoping to just the resource groups that contain your disks is fine
Azure Network Interfaces
Azure Network Interfaces Information Panel
1. The title "Azure Network Interfaces" indicates the section is about network interfaces in Azure.
2. Below the title, the description states the panel retrieves information about network interfaces and their performance metrics.
3. Tags such as "network," "network-interface," and "virtual-machine" categorize the information.
4. A "Use Driver" button is available for initiating the use of the network interface driver.
5. An additional menu, represented by three dots, provides more options related to the network interfaces.
Grant the app (service principal) read-only rights at the subscription (or specific RGs that contain the NICs):
- Microsoft.Network/networkInterfaces/read — list/read NIC resources
- Microsoft.Insights/metrics/read — read NIC metrics
Built-in role options
- Network Reader + Monitoring Reader (least-privilege combo), or
- Reader (broader read access at the scope)
Example custom role JSON (least privilege):
{
"Name": "Domotz - Azure NIC Read (Least Privilege)",
"IsCustom": true,
"Description": "Allows listing Azure Network Interfaces and reading their metrics for Domotz monitoring.",
"Actions": [
"Microsoft.Network/networkInterfaces/read",
"Microsoft.Insights/metrics/read",
"Microsoft.Insights/metricDefinitions/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/<SUBSCRIPTION_ID>"
// or narrow to specific RGs:
// "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>"
]
}Scoping to only the resource groups that hold your NICs is fine
Azure Storage Accounts
Azure Storage Accounts Interface
1. The title "Azure Storage Accounts" indicates the context, focusing on Azure-related storage solutions.
2. Underneath, the label "azure" is present, possibly signifying a category or tag related to Azure services.
3. The description explains that this interface retrieves information about Azure storage accounts and their performance metrics.
4. Two tags are visible: "storage-account" and "storage." These may help in filtering or categorizing the information.
5. A "Use Driver" button suggests an action to deploy or connect to the Azure storage account driver.
6. An ellipsis button (three dots) indicates additional options or settings related to Azure Storage Accounts.
Grant the app (service principal) read-only rights at the subscription (or specific RGs that contain the storage accounts):
- Microsoft.Storage/storageAccounts/read — list/read storage account resources
- Microsoft.Insights/metrics/read — read storage account metrics
Built-in role options
- Reader (broad read at scope), or
- Monitoring Reader + Reader on only the RGs with storage accounts (least-privilege combo)
Example custom role JSON (least privilege):
{
"Name": "Domotz - Azure Storage Accounts Read (Least Privilege)",
"IsCustom": true,
"Description": "Allows listing Azure Storage Accounts and reading their metrics for Domotz monitoring.",
"Actions": [
"Microsoft.Storage/storageAccounts/read",
"Microsoft.Insights/metrics/read",
"Microsoft.Insights/metricDefinitions/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/<SUBSCRIPTION_ID>"
// Or narrow to specific RGs:
// "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>"
]
}
Scoping to only the resource groups that hold your storage accounts is perfectly fine
Azure Virtual Machine Scale Sets
Azure Virtual Machine Scale Sets Overview
1. Title: Azure Virtual Machine Scale Sets.
2. Description: Monitor Azure Compute Virtual Machine Scale Sets with a script that retrieves information about these scale sets.
3. Tags: The tags include "compute" and "vm-scale-set."
4. Actions: To proceed, select the "Use Driver" button. There is an additional options menu represented by an ellipsis for more actions.
Grant the app (service principal) read-only rights where your VMSS live (subscription or specific RGs):
- Microsoft.Compute/virtualMachineScaleSets/read — list/read VMSS resources and properties
- Microsoft.Insights/metrics/read — read VMSS metrics
Built-in role options:
- Reader (broad read) + Monitoring Reader (metrics)
Example custom role JSON (least privilege):
{
"Name": "Domotz - Azure VM Scale Sets Read (Least Privilege)",
"IsCustom": true,
"Description": "Allows listing Azure VM Scale Sets and reading their metrics for Domotz monitoring.",
"Actions": [
"Microsoft.Compute/virtualMachineScaleSets/read",
"Microsoft.Insights/metrics/read",
"Microsoft.Insights/metricDefinitions/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/<SUBSCRIPTION_ID>"
// Or narrow scope, e.g.:
// "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>"
]
}Scoping to just the RGs containing the VMSS is fine
Azure VMs List
Azure VMs List Overview
1. Title: Azure VMs List with the Azure logo next to it.
2. Below the title, it indicates the category "azure."
3. Description: "Monitor Azure Compute Virtual Machines: this script retrieves information about Virtual Machine."
4. Tags: Two tags labeled "compute" and "virtual-machine."
5. Buttons: A "Use Driver" button for script activation, and an additional options button represented by three dots.
Minimal Azure permissions (read-only):
- Microsoft.Compute/virtualMachines/read — list/read VM resources and properties
Built-in role option
- Reader at the subscription or specific RGs (broader than needed, but works everywhere).
Least-privilege custom role JSON:
{
"Name": "Domotz - Azure VMs Read (Least Privilege)",
"IsCustom": true,
"Description": "Allows listing Azure Virtual Machines and reading their properties for Domotz monitoring.",
"Actions": [
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Resources/subscriptions/resourceGroups/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/<SUBSCRIPTION_ID>"
// Or narrow to RG scope:
// "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>"
]
}Azure Virtual Machine Scale Sets Metrics
Azure Virtual Machine Scale Sets Metrics Overview
1. Title and Category: "Azure Virtual Machine Scale Sets Metrics" with the category "azure."
2. Description: A brief overview states that the script monitors and retrieves information about Azure Compute Virtual Machine Scale Sets Metrics.
3. Tags: Two tags are displayed - "compute" and "vm-scale-set."
4. Action Buttons: Two buttons at the bottom - "Use Driver" for executing the script, and a settings or options button represented by three dots for additional options.
Grant these at the subscription (or narrower RG) scope:
- Microsoft.Compute/virtualMachineScaleSets/read — list/read VMSS properties (name, RG, OS disk size, controller type, etc.)
- Microsoft.Insights/metrics/read — read VMSS metrics via providers/microsoft.insights/metrics
Built-in role options (easier, broader):
- Reader (subscription/RG): includes both Compute read and Metrics read.
- Or Monitoring Reader + a role that gives virtualMachineScaleSets/read (e.g., Reader).
Monitoring Reader alone won’t let you enumerate VMSS resources.
Custom role JSON:
{
"Name": "Domotz - VMSS Metrics (Least Privilege)",
"IsCustom": true,
"Description": "Read VM Scale Sets and their Azure Monitor metrics for Domotz driver.",
"Actions": [
"Microsoft.Compute/virtualMachineScaleSets/read",
"Microsoft.Insights/metrics/read",
"Microsoft.Resources/subscriptions/resourceGroups/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/<SUBSCRIPTION_ID>"
// or narrow to an RG:
// "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>"
]
}Azure VMs List Metrics
Azure Virtual Machines Metrics Script Overview
1. Title: Azure VMs List Metrics.
2. Subtitle: Category is "azure.”
3. Description: The script monitors Azure Compute Virtual Machines Metrics by retrieving information about Virtual Machine Performance Metrics.
4. Tags: Includes "compute" and "virtual-machine."
5. Buttons: "Use Driver" and an additional options button represented by three dots. Use "Use Driver" to apply the script.
Assign at subscription scope (or narrower RG scope):
- Microsoft.Compute/virtualMachines/read — list VMs and read their properties.
- Microsoft.Compute/virtualMachines/instanceView/read — get instanceView (power state, agent/extensions, OS info).
- Microsoft.Insights/metrics/read — query Azure Monitor metrics for each VM.
Built-in role option:
- Reader at the subscription or specific RGs (broader than needed, but works everywhere).
Custom role JSON:
{
"Name": "Domotz - VM Metrics (Least Privilege)",
"IsCustom": true,
"Description": "Read Azure VM resources, instance view, and Azure Monitor metrics for Domotz driver.",
"Actions": [
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Compute/virtualMachines/instanceView/read",
"Microsoft.Insights/metrics/read",
"Microsoft.Resources/subscriptions/resourceGroups/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes": [
"/subscriptions/<SUBSCRIPTION_ID>"
// or narrow to one RG:
// "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG_NAME>"
]
}