Permissions required for scanning Azure subscriptions

Overview

For every subscription whose data you want to import via the Azure Hybrid Benefit extension, you need to set up access rights.

Permissions required for scanning an Azure subscription

To configure required permissions, open Subscriptions from Azure Portal home page and take the following steps for each subscription that will be scanned:

1. Click the subscription from the list of all subscriptions.
2. In the navigation pane click Resource Providers. Check that the following resource providers are listed as registered:

• Microsoft.ClassicSubscription
• Microsoft.Subscription
• Microsoft.SqlVirtualMachine
• Microsoft.Sql
• Microsoft.Compute
• Microsoft.Resources

3. In the navigation page for the same subscription, click Access Control.
4. On the Check access tab, click Add role assignment.
5. On the page that open, select Reader under Role > Job Function Roles.

6. Proceed to the next page and add a user whose credentials will be used to authenticate when creating the Azure Hybrid Benefit service connection.
7. Proceed to the next page and click Review + assign to finish the role assignment. 

On the Role assignments tab, you can see all current assignments.