Manual Service Account Creation

Owned by Integration Service Account
Last updated: 07 January 2024
1 min read

Manual Service Account Creation

If you do not have the required Azure Active Directory permissions to create the role, have an Azure AD administrator create the following resources:

  1. A service principal named armorsa and display name Armor Service Account

  2. A custom azure role with the following permissions with a scope of the target subscriptions:

    • Microsoft.Authorization/policies/audit/action

    • Microsoft.Authorization/policies/auditIfNotExists/action

    • Microsoft.Authorization/policyAssignments/read

    • Microsoft.Authorization/policyAssignments/write

    • Microsoft.Authorization/policyAssignments/delete

    • Microsoft.Authorization/roleAssignments/delete

    • Microsoft.Authorization/roleAssignments/read

    • Microsoft.Authorization/roleAssignments/write

    • Microsoft.Insights/Workbooks/Read

    • Microsoft.Insights/Workbooks/Write

    • Microsoft.Insights/Workbooks/Delete

    • Microsoft.Insights/diagnosticSettings/read

    • Microsoft.Insights/diagnosticSettings/write

    • Microsoft.Insights/diagnosticSettings/delete

    • Microsoft.Logic/workflows/read

    • Microsoft.Logic/workflows/write

    • Microsoft.Logic/workflows/delete

    • Microsoft.Logic/workflows/triggers/listCallbackUrl/action

    • Microsoft.Logic/workflows/triggers/read

    • Microsoft.Logic/workflows/triggers/reset/action

    • Microsoft.Logic/workflows/triggers/run/action

    • Microsoft.Logic/workflows/triggers/setState/action

    • Microsoft.ManagedServices/operationStatuses/read

    • Microsoft.ManagedServices/registrationAssignments/read

    • Microsoft.ManagedServices/registrationAssignments/write

    • Microsoft.ManagedServices/registrationAssignments/delete

    • Microsoft.ManagedServices/registrationDefinitions/read

    • Microsoft.ManagedServices/registrationDefinitions/write

    • Microsoft.ManagedServices/registrationDefinitions/delete

    • Microsoft.OperationalInsights/workspaces/read

    • Microsoft.OperationalInsights/workspaces/write

    • Microsoft.OperationalInsights/workspaces/datasources/read

    • Microsoft.OperationalInsights/workspaces/datasources/write

    • Microsoft.OperationalInsights/workspaces/datasources/delete

    • Microsoft.OperationalInsights/workspaces/savedSearches/read

    • Microsoft.OperationalInsights/workspaces/savedSearches/write

    • Microsoft.OperationalInsights/workspaces/savedSearches/delete

    • Microsoft.OperationalInsights/workspaces/sharedKeys/action

    • Microsoft.OperationsManagement/solutions/read

    • Microsoft.OperationsManagement/solutions/write

    • Microsoft.Resources/deployments/read

    • Microsoft.Resources/deployments/write

    • Microsoft.Resources/deployments/delete

    • Microsoft.Resources/deployments/exportTemplate/action

    • Microsoft.Resources/deployments/operationstatuses/read

    • Microsoft.Resources/deployments/validate/action

    • Microsoft.Resources/subscriptions/resourceGroups/read

    • Microsoft.Resources/subscriptions/resourceGroups/write

    • Microsoft.Resources/subscriptions/resourcegroups/deployments/read

    • Microsoft.Resources/subscriptions/resourcegroups/deployments/write

    • Microsoft.Resources/subscriptions/resourcegroups/resources/read

    • Microsoft.SecurityInsights/alertRules/read

    • Microsoft.SecurityInsights/alertRules/write

    • Microsoft.SecurityInsights/alertRules/delete

    • Microsoft.SecurityInsights/alertRules/actions/read

    • Microsoft.SecurityInsights/alertRules/actions/write

    • Microsoft.SecurityInsights/alertRules/actions/delete

    • Microsoft.SecurityInsights/automationRules/read

    • Microsoft.SecurityInsights/automationRules/write

    • Microsoft.SecurityInsights/automationRules/delete

    • Microsoft.SecurityInsights/dataConnectors/read

    • Microsoft.SecurityInsights/dataConnectors/write

    • Microsoft.SecurityInsights/dataConnectors/delete

    • Microsoft.SecurityInsights/Watchlists/*

    • Microsoft.Storage/storageAccounts/blobServices/read

    • Microsoft.Storage/storageAccounts/blobServices/write

    • Microsoft.Storage/storageAccounts/fileServices/read

    • Microsoft.Storage/storageAccounts/fileServices/write

    • Microsoft.Storage/storageAccounts/listkeys/action

    • Microsoft.Storage/storageAccounts/read

    • Microsoft.Storage/storageAccounts/write

    • Microsoft.Web/connections/Read

    • Microsoft.Web/connections/Write

    • Microsoft.Web/connections/Delete

    • Microsoft.Web/connections/Join/Action

    • Microsoft.Web/connections/Move/Action

    • Microsoft.Web/customApis/write

    • Microsoft.Web/customApis/join/action