permissions · azure

Microsoft Azure permissions

245

IAM actions total

120

read-only actions

125

write actions

services touched

What access does ZopNight need on Microsoft Azure?

ZopNight reads an Azure subscription through 3 built-in roles: Reader for inventory, Monitoring Reader for the utilisation metrics that idle findings need, and Cost Management Reader for spend. That is 120 read permissions. Acting on findings adds the custom Zopnight Write Access role, granted separately.

Filter actions

Databricks 7 read · 0 write

IAM actions ZopNight requests in the Databricks service on Microsoft Azure: 7 read, 0 write.
Action	Access	Purpose
Databricks/clusters/list	read	discovery
Databricks/instance-pools/list	read	discovery
Databricks/jobs/list	read	discovery
Databricks/jobs/runs/list	read	discovery
Databricks/serving-endpoints/list	read	discovery
Databricks/sql/history/queries	read	discovery
Databricks/sql/warehouses/list	read	discovery

Microsoft.App 1 read · 2 write

IAM actions ZopNight requests in the Microsoft.App service on Microsoft Azure: 1 read, 2 write.
Action	Access	Purpose
Microsoft.App/containerApps/read	read	discovery
Microsoft.App/containerApps/start/action	write	scheduling
Microsoft.App/containerApps/stop/action	write	scheduling

Microsoft.Authorization 2 read · 1 write

IAM actions ZopNight requests in the Microsoft.Authorization service on Microsoft Azure: 2 read, 1 write.
Action	Access	Purpose
Microsoft.Authorization/roleAssignments/read	read	probe
Microsoft.Authorization/roleDefinitions/read	read	probe
Microsoft.Authorization/roleAssignments/write	write	provisioning

Microsoft.Automation 0 read · 1 write

IAM actions ZopNight requests in the Microsoft.Automation service on Microsoft Azure: 0 read, 1 write.
Action	Access	Purpose
Microsoft.Automation/automationAccounts/delete	write	remediation

Microsoft.Batch 1 read · 1 write

IAM actions ZopNight requests in the Microsoft.Batch service on Microsoft Azure: 1 read, 1 write.
Action	Access	Purpose
Microsoft.Batch/batchAccounts/pools/read	read	discovery
Microsoft.Batch/batchAccounts/pools/write	write	scheduling

Microsoft.Cache 0 read · 3 write

IAM actions ZopNight requests in the Microsoft.Cache service on Microsoft Azure: 0 read, 3 write.
Action	Access	Purpose
Microsoft.Cache/redis/delete	write	provisioning
Microsoft.Cache/redis/read	write	provisioning
Microsoft.Cache/redis/write	write	provisioning

Microsoft.CognitiveServices 14 read · 1 write

IAM actions ZopNight requests in the Microsoft.CognitiveServices service on Microsoft Azure: 14 read, 1 write.
Action	Access	Purpose
Microsoft.CognitiveServices/accounts/capabilityHosts/read	read	discovery
Microsoft.CognitiveServices/accounts/commitmentPlans/read	read	discovery
Microsoft.CognitiveServices/accounts/connections/read	read	discovery
Microsoft.CognitiveServices/accounts/defenderForAISettings/read	read	discovery
Microsoft.CognitiveServices/accounts/deployments/read	read	discovery
Microsoft.CognitiveServices/accounts/encryptionScopes/read	read	discovery
Microsoft.CognitiveServices/accounts/managedComputeDeployments/read	read	discovery
Microsoft.CognitiveServices/accounts/networkSecurityPerimeterConfigurations/read	read	discovery
Microsoft.CognitiveServices/accounts/openai/read	read	discovery
Microsoft.CognitiveServices/accounts/projects/connections/read	read	discovery
Microsoft.CognitiveServices/accounts/projects/read	read	discovery
Microsoft.CognitiveServices/accounts/raiBlocklists/read	read	discovery
Microsoft.CognitiveServices/accounts/raiPolicies/read	read	discovery
Microsoft.CognitiveServices/accounts/read	read	discovery
Microsoft.CognitiveServices/accounts/write	write	scheduling

Microsoft.Compute 5 read · 13 write

IAM actions ZopNight requests in the Microsoft.Compute service on Microsoft Azure: 5 read, 13 write.
Action	Access	Purpose
Microsoft.Compute/disks/read	read	discovery; provisioning
Microsoft.Compute/snapshots/read	read	discovery
Microsoft.Compute/virtualMachines/extensions/read	read	discovery
Microsoft.Compute/virtualMachines/read	read	discovery,remediation; provisioning
Microsoft.Compute/virtualMachineScaleSets/read	read	discovery
Microsoft.Compute/disks/delete	write	remediation
Microsoft.Compute/disks/write	write	remediation; provisioning
Microsoft.Compute/snapshots/delete	write	remediation
Microsoft.Compute/virtualMachines/deallocate/action	write	scheduling; provisioning
Microsoft.Compute/virtualMachines/delete	write	provisioning
Microsoft.Compute/virtualMachines/runCommand/action	write	provisioning
Microsoft.Compute/virtualMachines/start/action	write	scheduling; provisioning
Microsoft.Compute/virtualMachines/write	write	remediation; provisioning
Microsoft.Compute/virtualMachineScaleSets/deallocate/action	write	scheduling
Microsoft.Compute/virtualMachineScaleSets/delete	write	provisioning
Microsoft.Compute/virtualMachineScaleSets/start/action	write	scheduling
Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action	write	provisioning
Microsoft.Compute/virtualMachineScaleSets/write	write	scheduling

Microsoft.ContainerRegistry 0 read · 3 write

IAM actions ZopNight requests in the Microsoft.ContainerRegistry service on Microsoft Azure: 0 read, 3 write.
Action	Access	Purpose
Microsoft.ContainerRegistry/registries/delete	write	remediation; deployments
Microsoft.ContainerRegistry/registries/read	write	deployments
Microsoft.ContainerRegistry/registries/write	write	deployments

Microsoft.ContainerService 44 read · 16 write

IAM actions ZopNight requests in the Microsoft.ContainerService service on Microsoft Azure: 44 read, 16 write.
Action	Access	Purpose
Microsoft.ContainerService/managedClusters/agentPools/read	read	discovery
Microsoft.ContainerService/managedClusters/apiextensions.k8s.io/customresourcedefinitions/read	read	discovery
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/read	read	discovery
Microsoft.ContainerService/managedClusters/apps/daemonsets/read	read	discovery
Microsoft.ContainerService/managedClusters/apps/deployments/read	read	discovery
Microsoft.ContainerService/managedClusters/apps/replicasets/read	read	discovery
Microsoft.ContainerService/managedClusters/apps/statefulsets/read	read	discovery
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/read	read	discovery
Microsoft.ContainerService/managedClusters/batch/cronjobs/read	read	discovery
Microsoft.ContainerService/managedClusters/batch/jobs/read	read	discovery
Microsoft.ContainerService/managedClusters/configmaps/read	read	discovery
Microsoft.ContainerService/managedClusters/customresources/read	read	discovery
Microsoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/read	read	discovery
Microsoft.ContainerService/managedClusters/endpoints/read	read	discovery
Microsoft.ContainerService/managedClusters/events.k8s.io/events/read	read	discovery
Microsoft.ContainerService/managedClusters/events/read	read	discovery
Microsoft.ContainerService/managedClusters/extensions/daemonsets/read	read	discovery
Microsoft.ContainerService/managedClusters/extensions/deployments/read	read	discovery
Microsoft.ContainerService/managedClusters/extensions/ingresses/read	read	discovery
Microsoft.ContainerService/managedClusters/extensions/networkpolicies/read	read	discovery
Microsoft.ContainerService/managedClusters/extensions/replicasets/read	read	discovery
Microsoft.ContainerService/managedClusters/limitranges/read	read	discovery
Microsoft.ContainerService/managedClusters/listClusterUserCredential/action	read	discovery
Microsoft.ContainerService/managedClusters/metrics.k8s.io/nodes/read	read	discovery
Microsoft.ContainerService/managedClusters/metrics.k8s.io/pods/read	read	discovery
Microsoft.ContainerService/managedClusters/namespaces/read	read	discovery
Microsoft.ContainerService/managedClusters/networking.k8s.io/ingresses/read	read	discovery
Microsoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/read	read	discovery
Microsoft.ContainerService/managedClusters/nodes/read	read	discovery
Microsoft.ContainerService/managedClusters/persistentvolumeclaims/read	read	discovery
Microsoft.ContainerService/managedClusters/persistentvolumes/read	read	discovery
Microsoft.ContainerService/managedClusters/pods/read	read	discovery
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/read	read	discovery
Microsoft.ContainerService/managedClusters/rbac.authorization.k8s.io/clusterrolebindings/read	read	discovery
Microsoft.ContainerService/managedClusters/rbac.authorization.k8s.io/clusterroles/read	read	discovery
Microsoft.ContainerService/managedClusters/rbac.authorization.k8s.io/rolebindings/read	read	discovery
Microsoft.ContainerService/managedClusters/rbac.authorization.k8s.io/roles/read	read	discovery
Microsoft.ContainerService/managedClusters/read	read	discovery
Microsoft.ContainerService/managedClusters/replicationcontrollers/read	read	discovery
Microsoft.ContainerService/managedClusters/resourcequotas/read	read	discovery
Microsoft.ContainerService/managedClusters/secrets/read	read	discovery
Microsoft.ContainerService/managedClusters/serviceaccounts/read	read	discovery
Microsoft.ContainerService/managedClusters/services/read	read	discovery
Microsoft.ContainerService/managedClusters/storage.k8s.io/storageclasses/read	read	discovery
Microsoft.ContainerService/managedClusters/agentPools/delete	write	provisioning
Microsoft.ContainerService/managedClusters/agentPools/write	write	scheduling
Microsoft.ContainerService/managedClusters/apps/daemonsets/write	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/apps/deployments/write	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/apps/statefulsets/write	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/delete	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/write	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/batch/cronjobs/write	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/customresources/delete	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/customresources/write	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/delete	write	provisioning
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/delete	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/policy/poddisruptionbudgets/write	write	namespace_scheduling
Microsoft.ContainerService/managedClusters/start/action	write	scheduling
Microsoft.ContainerService/managedClusters/stop/action	write	scheduling
Microsoft.ContainerService/managedClusters/write	write	provisioning

Microsoft.CostManagement 1 read · 0 write

IAM actions ZopNight requests in the Microsoft.CostManagement service on Microsoft Azure: 1 read, 0 write.
Action	Access	Purpose
Microsoft.CostManagement/query/read	read	cost,discovery

Microsoft.Databricks 1 read · 1 write

IAM actions ZopNight requests in the Microsoft.Databricks service on Microsoft Azure: 1 read, 1 write.
Action	Access	Purpose
Microsoft.Databricks/workspaces/read	read	discovery
Microsoft.Databricks/workspaces/write	write	scheduling

Microsoft.DataFactory 2 read · 5 write

IAM actions ZopNight requests in the Microsoft.DataFactory service on Microsoft Azure: 2 read, 5 write.
Action	Access	Purpose
Microsoft.DataFactory/factories/integrationRuntimes/read	read	discovery
Microsoft.DataFactory/factories/read	read	discovery
Microsoft.DataFactory/factories/integrationRuntimes/start/action	write	scheduling
Microsoft.DataFactory/factories/integrationRuntimes/stop/action	write	scheduling
Microsoft.DataFactory/factories/triggers/start/action	write	scheduling
Microsoft.DataFactory/factories/triggers/stop/action	write	scheduling
Microsoft.DataFactory/factories/write	write	scheduling

Microsoft.DBforMySQL 1 read · 4 write

IAM actions ZopNight requests in the Microsoft.DBforMySQL service on Microsoft Azure: 1 read, 4 write.
Action	Access	Purpose
Microsoft.DBforMySQL/flexibleServers/read	read	discovery
Microsoft.DBforMySQL/flexibleServers/delete	write	provisioning
Microsoft.DBforMySQL/flexibleServers/start/action	write	scheduling
Microsoft.DBforMySQL/flexibleServers/stop/action	write	scheduling
Microsoft.DBforMySQL/flexibleServers/write	write	remediation; provisioning

Microsoft.DBforPostgreSQL 1 read · 4 write

IAM actions ZopNight requests in the Microsoft.DBforPostgreSQL service on Microsoft Azure: 1 read, 4 write.
Action	Access	Purpose
Microsoft.DBforPostgreSQL/flexibleServers/read	read	discovery
Microsoft.DBforPostgreSQL/flexibleServers/delete	write	provisioning
Microsoft.DBforPostgreSQL/flexibleServers/start/action	write	scheduling
Microsoft.DBforPostgreSQL/flexibleServers/stop/action	write	scheduling
Microsoft.DBforPostgreSQL/flexibleServers/write	write	provisioning

Microsoft.EventHub 0 read · 1 write

IAM actions ZopNight requests in the Microsoft.EventHub service on Microsoft Azure: 0 read, 1 write.
Action	Access	Purpose
Microsoft.EventHub/namespaces/delete	write	remediation

Microsoft.Insights 5 read · 2 write

IAM actions ZopNight requests in the Microsoft.Insights service on Microsoft Azure: 5 read, 2 write.
Action	Access	Purpose
Microsoft.Insights/autoscalesettings/read	read	discovery
Microsoft.Insights/eventTypes/values/read	read	recommendations
Microsoft.Insights/metricAlerts/read	read	discovery
Microsoft.Insights/metrics/read	read	recommendations
Microsoft.Insights/scheduledQueryRules/read	read	discovery
Microsoft.Insights/autoscalesettings/delete	write	scheduling
Microsoft.Insights/autoscalesettings/write	write	scheduling

Microsoft.KeyVault 0 read · 7 write

IAM actions ZopNight requests in the Microsoft.KeyVault service on Microsoft Azure: 0 read, 7 write.
Action	Access	Purpose
Microsoft.KeyVault/vaults/delete	write	remediation; deployments
Microsoft.KeyVault/vaults/read	write	deployments
Microsoft.KeyVault/vaults/secrets/getSecret/action	write	deployments
Microsoft.KeyVault/vaults/secrets/read	write	deployments
Microsoft.KeyVault/vaults/secrets/setSecret/action	write	deployments
Microsoft.KeyVault/vaults/secrets/write	write	deployments
Microsoft.KeyVault/vaults/write	write	deployments

Microsoft.Kusto 1 read · 2 write

IAM actions ZopNight requests in the Microsoft.Kusto service on Microsoft Azure: 1 read, 2 write.
Action	Access	Purpose
Microsoft.Kusto/Clusters/read	read	discovery
Microsoft.Kusto/Clusters/start/action	write	scheduling
Microsoft.Kusto/Clusters/stop/action	write	scheduling

Microsoft.MachineLearningServices 12 read · 3 write

IAM actions ZopNight requests in the Microsoft.MachineLearningServices service on Microsoft Azure: 12 read, 3 write.
Action	Access	Purpose
Microsoft.MachineLearningServices/registries/read	read	discovery
Microsoft.MachineLearningServices/workspaces/components/read	read	discovery
Microsoft.MachineLearningServices/workspaces/computes/read	read	discovery
Microsoft.MachineLearningServices/workspaces/connections/read	read	discovery
Microsoft.MachineLearningServices/workspaces/data/read	read	discovery
Microsoft.MachineLearningServices/workspaces/datastores/read	read	discovery
Microsoft.MachineLearningServices/workspaces/environments/read	read	discovery
Microsoft.MachineLearningServices/workspaces/featuresets/read	read	discovery
Microsoft.MachineLearningServices/workspaces/featurestoreentities/read	read	discovery
Microsoft.MachineLearningServices/workspaces/jobs/read	read	discovery
Microsoft.MachineLearningServices/workspaces/models/read	read	discovery
Microsoft.MachineLearningServices/workspaces/schedules/read	read	discovery
Microsoft.MachineLearningServices/workspaces/computes/start/action	write	scheduling
Microsoft.MachineLearningServices/workspaces/computes/stop/action	write	scheduling
Microsoft.MachineLearningServices/workspaces/computes/write	write	scheduling

Microsoft.Network 1 read · 36 write

IAM actions ZopNight requests in the Microsoft.Network service on Microsoft Azure: 1 read, 36 write.
Action	Access	Purpose
Microsoft.Network/ddosProtectionPlans/read	read	discovery
Microsoft.Network/dnsZones/A/write	write	provisioning
Microsoft.Network/dnsZones/delete	write	provisioning
Microsoft.Network/dnsZones/read	write	provisioning
Microsoft.Network/dnsZones/recordSets/read	write	provisioning
Microsoft.Network/dnsZones/write	write	provisioning
Microsoft.Network/loadBalancers/delete	write	provisioning
Microsoft.Network/loadBalancers/read	write	provisioning
Microsoft.Network/loadBalancers/write	write	provisioning
Microsoft.Network/networkInterfaces/delete	write	provisioning
Microsoft.Network/networkInterfaces/join/action	write	provisioning
Microsoft.Network/networkInterfaces/read	write	provisioning
Microsoft.Network/networkInterfaces/write	write	provisioning
Microsoft.Network/networkSecurityGroups/delete	write	remediation; provisioning
Microsoft.Network/networkSecurityGroups/join/action	write	provisioning
Microsoft.Network/networkSecurityGroups/read	write	provisioning
Microsoft.Network/networkSecurityGroups/write	write	provisioning
Microsoft.Network/privateDnsZones/delete	write	provisioning
Microsoft.Network/privateDnsZones/read	write	provisioning
Microsoft.Network/privateDnsZones/virtualNetworkLinks/delete	write	provisioning
Microsoft.Network/privateDnsZones/virtualNetworkLinks/read	write	provisioning
Microsoft.Network/privateDnsZones/virtualNetworkLinks/write	write	provisioning
Microsoft.Network/privateDnsZones/write	write	provisioning
Microsoft.Network/publicIPAddresses/delete	write	remediation; provisioning
Microsoft.Network/publicIPAddresses/join/action	write	provisioning
Microsoft.Network/publicIPAddresses/read	write	provisioning
Microsoft.Network/publicIPAddresses/write	write	provisioning
Microsoft.Network/virtualNetworks/delete	write	provisioning
Microsoft.Network/virtualNetworks/read	write	discovery; provisioning
Microsoft.Network/virtualNetworks/subnets/delete	write	provisioning
Microsoft.Network/virtualNetworks/subnets/join/action	write	provisioning
Microsoft.Network/virtualNetworks/subnets/read	write	provisioning
Microsoft.Network/virtualNetworks/subnets/write	write	provisioning
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete	write	remediation; provisioning
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read	write	provisioning
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write	write	provisioning
Microsoft.Network/virtualNetworks/write	write	provisioning

Microsoft.OperationalInsights 1 read · 1 write

IAM actions ZopNight requests in the Microsoft.OperationalInsights service on Microsoft Azure: 1 read, 1 write.
Action	Access	Purpose
Microsoft.OperationalInsights/workspaces/read	read	remediation
Microsoft.OperationalInsights/workspaces/write	write	remediation

Microsoft.RecoveryServices 6 read · 4 write

IAM actions ZopNight requests in the Microsoft.RecoveryServices service on Microsoft Azure: 6 read, 4 write.
Action	Access	Purpose
Microsoft.RecoveryServices/vaults/backupconfig/read	read	discovery
Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/read	read	discovery
Microsoft.RecoveryServices/vaults/backupPolicies/read	read	discovery
Microsoft.RecoveryServices/vaults/backupProtectedItems/read	read	discovery
Microsoft.RecoveryServices/vaults/backupstorageconfig/read	read	discovery
Microsoft.RecoveryServices/vaults/read	read	discovery
Microsoft.RecoveryServices/vaults/backupPolicies/write	write	remediation
Microsoft.RecoveryServices/vaults/backupstorageconfig/write	write	remediation
Microsoft.RecoveryServices/vaults/delete	write	remediation
Microsoft.RecoveryServices/vaults/write	write	remediation

Microsoft.ResourceGraph 1 read · 0 write

IAM actions ZopNight requests in the Microsoft.ResourceGraph service on Microsoft Azure: 1 read, 0 write.
Action	Access	Purpose
Microsoft.ResourceGraph/resources/read	read	discovery,recommendations

Microsoft.Resources 2 read · 2 write

IAM actions ZopNight requests in the Microsoft.Resources service on Microsoft Azure: 2 read, 2 write.
Action	Access	Purpose
Microsoft.Resources/subscriptions/read	read	discovery
Microsoft.Resources/subscriptions/resourceGroups/read	read	discovery
Microsoft.Resources/subscriptions/resourceGroups/delete	write	provisioning
Microsoft.Resources/subscriptions/resourceGroups/write	write	provisioning

Microsoft.Search 2 read · 0 write

IAM actions ZopNight requests in the Microsoft.Search service on Microsoft Azure: 2 read, 0 write.
Action	Access	Purpose
Microsoft.Search/searchServices/listAdminKeys/action	read	discovery
Microsoft.Search/searchServices/read	read	discovery

Microsoft.Security 1 read · 0 write

IAM actions ZopNight requests in the Microsoft.Security service on Microsoft Azure: 1 read, 0 write.
Action	Access	Purpose
Microsoft.Security/locations/jitNetworkAccessPolicies/read	read	discovery

Microsoft.ServiceBus 0 read · 1 write

IAM actions ZopNight requests in the Microsoft.ServiceBus service on Microsoft Azure: 0 read, 1 write.
Action	Access	Purpose
Microsoft.ServiceBus/namespaces/delete	write	remediation

Microsoft.Sql 2 read · 2 write

IAM actions ZopNight requests in the Microsoft.Sql service on Microsoft Azure: 2 read, 2 write.
Action	Access	Purpose
Microsoft.Sql/servers/databases/read	read	discovery
Microsoft.Sql/servers/securityAlertPolicies/read	read	discovery
Microsoft.Sql/servers/databases/pause/action	write	scheduling
Microsoft.Sql/servers/databases/resume/action	write	scheduling

Microsoft.Storage 2 read · 2 write

IAM actions ZopNight requests in the Microsoft.Storage service on Microsoft Azure: 2 read, 2 write.
Action	Access	Purpose
Microsoft.Storage/storageAccounts/managementPolicies/read	read	discovery
Microsoft.Storage/storageAccounts/read	read	discovery
Microsoft.Storage/storageAccounts/delete	write	remediation
Microsoft.Storage/storageAccounts/write	write	remediation

Microsoft.Synapse 1 read · 2 write

IAM actions ZopNight requests in the Microsoft.Synapse service on Microsoft Azure: 1 read, 2 write.
Action	Access	Purpose
Microsoft.Synapse/workspaces/sqlPools/read	read	discovery
Microsoft.Synapse/workspaces/sqlPools/pause/action	write	scheduling
Microsoft.Synapse/workspaces/sqlPools/resume/action	write	scheduling

Microsoft.Web 3 read · 5 write

IAM actions ZopNight requests in the Microsoft.Web service on Microsoft Azure: 3 read, 5 write.
Action	Access	Purpose
Microsoft.Web/serverfarms/read	read	remediation
Microsoft.Web/sites/config/read	read	discovery
Microsoft.Web/sites/read	read	discovery
Microsoft.Web/serverfarms/delete	write	remediation
Microsoft.Web/serverfarms/write	write	remediation
Microsoft.Web/sites/start/action	write	scheduling
Microsoft.Web/sites/stop/action	write	scheduling
Microsoft.Web/sites/write	write	scheduling

Reader roles now, Zopnight Write Access later

Azure is role-based rather than action-based, so the honest answer is a list of roles, not a list of strings. Read-only discovery needs Reader at subscription scope, Monitoring Reader for the utilisation metrics that idle and rightsizing findings depend on, and Cost Management Reader for spend.

That is the whole read grant: 120 permissions, none of which can change anything.

Acting on findings needs the custom Zopnight Write Access role, plus Zopnight AKS Access for cluster and node-pool operations and Zopnight Databricks Access if you run Databricks on Azure. 125 write permissions across those three.

Service principal or workload identity federation?

Both are supported and the choice is a real one.

Workload identity federation stores no secret. Azure trusts a ZopNight OIDC token directly, so there is nothing to rotate and nothing to leak. Prefer it.
Service principal uses a client ID, secret and tenant ID. Universally supported, but the secret is stored and you own its rotation.

Why deallocate, not power off

Stopping an Azure VM through the guest OS leaves it allocated, and an allocated VM keeps billing for compute. ZopNight always issues deallocate, which releases the capacity and stops the compute charge. The disks keep billing either way, which is a separate finding.

This is why the write role needs virtualMachines/deallocate/action specifically, and why granting only powerOff/action produces schedules that appear to work and save nothing.

Namespace scheduling

AKS carries an extra purpose, namespace_scheduling: scaling every Deployment and StatefulSet in a namespace to zero and suspending its CronJobs, then restoring the prior replica counts. It needs cluster access rather than subscription-level rights, which is why it sits in its own role instead of the general write grant.

faq · azure

Microsoft Azure permissions: common questions

Which Azure roles does ZopNight need?

Three built-in ones for reading: Reader at subscription scope for inventory, Monitoring Reader for the utilisation metrics that idle and rightsizing findings depend on, and Cost Management Reader for spend. That is 120 read permissions, none of which can change anything.

Is Contributor or Owner ever required?

No. Writes come from the custom Zopnight Write Access role, plus Zopnight AKS Access for cluster and node-pool operations and Zopnight Databricks Access if you run Databricks on Azure. That is 125 write permissions across the three.

Why does the write role need deallocate rather than powerOff?

Because a VM that is stopped but still allocated keeps billing for compute. ZopNight issues Microsoft.Compute/virtualMachines/deallocate/action, which releases the capacity. Granting powerOff/action instead produces schedules that appear to work and save nothing.

The Hidden Cost of Ephemeral Records

Founded 2024.

Media Kit

Contact

zopnight playground

zopday playground