Manual Service Account Creation

Manual Service Account Creation

If you do not have the required Azure Active Directory permissions to create the role, have an Azure AD administrator create the following resources:

1. A service principal named armorsa and display name Armor Service Account

2. A custom azure role with the following permissions with a scope of the target subscriptions:

   • Microsoft.Authorization/policies/audit/action
   • Microsoft.Authorization/policies/auditIfNotExists/action
   • Microsoft.Authorization/policyAssignments/read
   • Microsoft.Authorization/policyAssignments/write
   • Microsoft.Authorization/policyAssignments/delete
   • Microsoft.Authorization/roleAssignments/delete
   • Microsoft.Authorization/roleAssignments/read
   • Microsoft.Authorization/roleAssignments/write
   • Microsoft.Insights/Workbooks/Read
   • Microsoft.Insights/Workbooks/Write
   • Microsoft.Insights/Workbooks/Delete
   • Microsoft.Insights/diagnosticSettings/read
   • Microsoft.Insights/diagnosticSettings/write
   • Microsoft.Insights/diagnosticSettings/delete
   • Microsoft.Logic/workflows/read
   • Microsoft.Logic/workflows/write
   • Microsoft.Logic/workflows/delete
   • Microsoft.Logic/workflows/triggers/listCallbackUrl/action
   • Microsoft.Logic/workflows/triggers/read
   • Microsoft.Logic/workflows/triggers/reset/action
   • Microsoft.Logic/workflows/triggers/run/action
   • Microsoft.Logic/workflows/triggers/setState/action
   • Microsoft.ManagedServices/operationStatuses/read
   • Microsoft.ManagedServices/registrationAssignments/read
   • Microsoft.ManagedServices/registrationAssignments/write
   • Microsoft.ManagedServices/registrationAssignments/delete
   • Microsoft.ManagedServices/registrationDefinitions/read
   • Microsoft.ManagedServices/registrationDefinitions/write
   • Microsoft.ManagedServices/registrationDefinitions/delete
   • Microsoft.OperationalInsights/workspaces/read
   • Microsoft.OperationalInsights/workspaces/write
   • Microsoft.OperationalInsights/workspaces/datasources/read
   • Microsoft.OperationalInsights/workspaces/datasources/write
   • Microsoft.OperationalInsights/workspaces/datasources/delete
   • Microsoft.OperationalInsights/workspaces/savedSearches/read
   • Microsoft.OperationalInsights/workspaces/savedSearches/write
   • Microsoft.OperationalInsights/workspaces/savedSearches/delete
   • Microsoft.OperationalInsights/workspaces/sharedKeys/action
   • Microsoft.OperationsManagement/solutions/read
   • Microsoft.OperationsManagement/solutions/write
   • Microsoft.Resources/deployments/read
   • Microsoft.Resources/deployments/write
   • Microsoft.Resources/deployments/delete
   • Microsoft.Resources/deployments/exportTemplate/action
   • Microsoft.Resources/deployments/operationstatuses/read
   • Microsoft.Resources/deployments/validate/action
   • Microsoft.Resources/subscriptions/resourceGroups/read
   • Microsoft.Resources/subscriptions/resourceGroups/write
   • Microsoft.Resources/subscriptions/resourcegroups/deployments/read
   • Microsoft.Resources/subscriptions/resourcegroups/deployments/write
   • Microsoft.Resources/subscriptions/resourcegroups/resources/read
   • Microsoft.SecurityInsights/alertRules/read
   • Microsoft.SecurityInsights/alertRules/write
   • Microsoft.SecurityInsights/alertRules/delete
   • Microsoft.SecurityInsights/alertRules/actions/read
   • Microsoft.SecurityInsights/alertRules/actions/write
   • Microsoft.SecurityInsights/alertRules/actions/delete
   • Microsoft.SecurityInsights/automationRules/read
   • Microsoft.SecurityInsights/automationRules/write
   • Microsoft.SecurityInsights/automationRules/delete
   • Microsoft.SecurityInsights/dataConnectors/read
   • Microsoft.SecurityInsights/dataConnectors/write
   • Microsoft.SecurityInsights/dataConnectors/delete
   • Microsoft.SecurityInsights/Watchlists/*
   • Microsoft.Storage/storageAccounts/blobServices/read
   • Microsoft.Storage/storageAccounts/blobServices/write
   • Microsoft.Storage/storageAccounts/fileServices/read
   • Microsoft.Storage/storageAccounts/fileServices/write
   • Microsoft.Storage/storageAccounts/listkeys/action
   • Microsoft.Storage/storageAccounts/read
   • Microsoft.Storage/storageAccounts/write
   • Microsoft.Web/connections/Read
   • Microsoft.Web/connections/Write
   • Microsoft.Web/connections/Delete
   • Microsoft.Web/connections/Join/Action
   • Microsoft.Web/connections/Move/Action
   • Microsoft.Web/customApis/write
   • Microsoft.Web/customApis/join/action