Your IT-systems Permissions

API / Permissions name	Type	Permission description	Admin consent required	Why do we need this permission?
Group.ReadWrite.All	Application	Allows the app to create groups, read all group properties and memberships, update group properties and memberships, and delete groups. Also allows the app to read and write conversations. All of these operations can be performed by the app without a signed-in user.	Yes	Used to create Microsoft Entra ID security groups that will be associated with management groups.
AppRoleAssignment.ReadWrite.All	Application	Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, without a signed-in user.	Yes	Used to assign Federated Workload Identity permissions to deploy, create and manage Microsoft Entra ID security groups to provide permissions within the Azure environment.
Application.ReadWrite.All	Application	Allows the calling app to create, and manage (read, update, update application secrets and delete) applications and service principals without a signed-in user. Does not allow management of consent grants or application assignments to users or groups.	Yes	Used in order to create and modify the Enterprise Applications needed to manage and govern the Azure environment.
RoleManagement.ReadWrite.Directory	Application	Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.	Yes	Used to set `-IsAssignableToRole:$true` and configure PIM Microsoft Entra ID Security groups that will be associated with Your IT-systems.
RoleManagementPolicy.ReadWrite.AzureADGroup	Application	Allows the app to read, update, and delete policies in Privileged Identity Management for Groups, on behalf of the signed-in user.	Yes	Used to configure privileged Identity Management (PIM) Microsoft Entra ID Security groups that will be associated with Your IT-systems.

Azure platform access

Some functionality needs access to your Azure environment to for example deploy important updates to Azure resources.

Access level	Scope	Justification
Management Group Contributor	Root ( "/" )	We need this access to be able to deploy resources, automatically manage and govern the Management groups in the Azure environment.
Template Spec Contributor	Root ( "/" )	Allows for deployment on root level, needed for automatic deployment of Management groups and other services.
Reader	Root ( "/" )	To read all settings, resources, and services in the customer tenant to support management and proactive tasks.
Reservations Reader	/providers/Microsoft.Capacity	We need this access to be able to read reservations to alert about underutilized and expiring reservations instances.
*/read	Management Group: {tenantId}	To read all settings, resources, and services in the customer tenant to support management and proactive tasks.
Microsoft.Resources/tags/write	Management Group: {tenantId}	Write tags on all resources, this include tags like createdBy, createdAt.
Microsoft.CostManagement/scheduledActions/write	Management Group: {tenantId}	Create Azure Budgets to manage and have cost management across the whole tenant.
Microsoft.CostManagement/scheduledActions/delete	Management Group: {tenantId}	Delete and clean up Azure Budgets to manage cost across the whole tenant.
*/register/action	Management Group: {tenantId}	Used to register any resource provides across tenant. This can be resource providers like Microsoft.ClassicNetworks
Microsoft.Management/managementGroups/settings/write	Management Group: {tenantId}	Used to set default subscription management group and security settings.
Microsoft.Resources/deployments/validate/*	Management Group: Decommissioned	To validate Azure deployments on management group level.
Microsoft.Resources/deployments/write	Management Group: Decommissioned	To deploy and write Azure deployments on management group level.
Microsoft.Resources/deploymentStacks/validate/*	Management Group: Decommissioned	To validate Azure deployment stacks on management group level.
Microsoft.Resources/deploymentStacks/write	Management Group: Decommissioned	To deploy and write Azure deployment stacks on management group level.
Microsoft.Resources/deploymentStacks/delete	Management Group: Decommissioned	To deploy and delete Azure deployment stacks on management group level.
Microsoft.Authorization/policyDefinitions/write	Management Group: Decommissioned	Write and create Azure policy definitions on management group level.
Microsoft.Authorization/policyDefinitions/delete	Management Group: Decommissioned	Delete Azure policy definitions on management group level.
Microsoft.Authorization/policyAssignments/write	Management Group: Decommissioned	Write and create Azure policy assignments on management group level.
Microsoft.Authorization/policyAssignments/delete	Management Group: Decommissioned	Delete Azure policy assignments on management group level.
*/read	Management Group: Ironstone Managed	Supports reading tenant settings, resources, and services for management and proactive tasks.
Microsoft.RecoveryServices/vaults/backupPolicies/write	Management Group: Ironstone Managed	Enables creation and updates of Azure Recovery Services backup policies for managed workloads.
Microsoft.Resources/deployments/validate/*	Management Group: Ironstone Managed	Azure deployments can be validated before managed changes are applied.
Microsoft.Resources/deployments/write	Management Group: Ironstone Managed	Required for deploying and writing Azure resources in the managed environment.
Microsoft.Resources/deploymentStacks/validate/*	Management Group: Ironstone Managed	Allows Azure deployment stacks to be validated before managed changes are applied.
Microsoft.Resources/deploymentStacks/write	Management Group: Ironstone Managed	Provides the ability to deploy and write Azure deployment stacks in the managed environment.
Microsoft.Authorization/policyDefinitions/write	Management Group: Ironstone Managed	Azure policy definitions can be created and updated for governance and compliance.
Microsoft.PolicyInsights/remediations/write	Management Group: Ironstone Managed	Policy remediations can be created to bring managed resources into compliance.
Microsoft.Resources/subscriptions/resourcegroups/write	Management Group: Ironstone Managed	Resource groups can be created and updated for managed Azure services.
Microsoft.Resources/tags/write	Management Group: Ironstone Managed	Managed resources can be tagged for ownership, lifecycle, and cost management.
Microsoft.Authorization/roleDefinitions/write	Management Group: Ironstone Managed	Custom role definitions can be created and updated for least-privilege management.
Microsoft.Authorization/roleEligibilityScheduleRequests/write	Management Group: Ironstone Managed	Supports management of eligible role assignments through Azure privileged access workflows.
Microsoft.Maintenance/maintenanceConfigurations/write	Management Group: Ironstone Managed	Maintenance configurations can be created and updated for managed patching schedules.
Microsoft.RecoveryServices/vaults/write	Management Group: Ironstone Managed	Recovery Services vaults can be created and updated for backup and disaster recovery.
Microsoft.Authorization/policyAssignments/write	Management Group: Ironstone Managed	Azure policy assignments can be created and updated for governance and compliance.
Microsoft.Authorization/roleAssignments/*	Management Group: Ironstone Managed	Required to manage Azure role assignments for least-privilege access to managed resources.
Microsoft.CostManagement/scheduledActions/write	Management Group: Ironstone Managed	Scheduled cost management actions, such as budget alerts, can be created and updated.
Microsoft.RecoveryServices/vaults/backupResourceGuardProxies/write	Management Group: Ironstone Managed	Backup resource guard proxies can be configured to protect backup operations.
Microsoft.RecoveryServices/vaults/replicationAlertSettings/write	Management Group: Ironstone Managed	Replication alert settings can be configured for disaster recovery monitoring.
Microsoft.RecoveryServices/vaults/backupFabrics/*/write	Management Group: Ironstone Managed	To set configure and manage replication on resources.
Microsoft.RecoveryServices/vaults/backupFabrics/*/action	Management Group: Ironstone Managed	To set configure and set replication on resources.
Microsoft.DataProtection/*/write	Management Group: Ironstone Managed	Azure Data Protection resources can be created and updated for managed backups.
Microsoft.OperationalInsights/workspaces/write	Management Group: Ironstone Managed	Log Analytics workspaces can be created and updated for monitoring and diagnostics.
Microsoft.Storage/storageAccounts/write	Management Group: Ironstone Managed	Storage accounts required by managed Azure services can be created and updated.
*/register/action	Management Group: Ironstone Managed	Azure resource providers can be registered as needed to deploy and manage services.
Microsoft.Storage/storageAccounts/*/write	Management Group: Ironstone Managed	Storage account child resources used by managed services can be configured.
Microsoft.Insights/components/write	Management Group: Ironstone Managed	Application Insights components can be created and updated for application monitoring.
Microsoft.Web/serverfarms/write	Management Group: Ironstone Managed	App Service plans can be created and updated for managed web and function apps.
Microsoft.Web/sites/write	Management Group: Ironstone Managed	App Service and Function App resources can be created and updated.
Microsoft.Storage/storageAccounts/listKeys/action	Management Group: Ironstone Managed	Storage account keys can be retrieved when managed services need storage connectivity.
Microsoft.Web/sites/publish/action	Management Group: Ironstone Managed	Application code and configuration can be published to managed web and function apps.
Microsoft.Web/sites/restart/action	Management Group: Ironstone Managed	Managed web and function apps can be restarted after deployments or configuration changes.
Microsoft.Web/sites/functions/write	Management Group: Ironstone Managed	Functions can be created and updated in managed Function Apps.
Microsoft.Web/sites/syncfunctiontriggers/action	Management Group: Ironstone Managed	Function App triggers can be synchronized after deployments and configuration updates.
Microsoft.EventGrid/systemTopics/write	Management Group: Ironstone Managed	Event Grid system topics can be created and updated for managed event-driven automation.
Microsoft.EventGrid/eventSubscriptions/write	Management Group: Ironstone Managed	Event Grid subscriptions can be created and updated for managed event routing.
Microsoft.EventGrid/systemTopics/eventSubscriptions/write	Management Group: Ironstone Managed	Subscriptions on Event Grid system topics can be created and updated for automation.
Microsoft.Maintenance/maintenanceConfigurations/eventGridFilters/write	Management Group: Ironstone Managed	Event Grid filters can be configured for maintenance configuration events.
Microsoft.Compute/virtualMachines/write	Management Group: Ironstone Managed	Virtual machines can be created and updated in the managed environment.
Microsoft.Compute/virtualMachines/runCommand/action	Management Group: Ironstone Managed	Commands can be run on managed virtual machines for configuration and troubleshooting.
Microsoft.Compute/disks/write	Management Group: Ironstone Managed	Managed disks used by virtual machines can be created and updated.
Microsoft.Network/virtualNetworks/write	Management Group: Ironstone Managed	Virtual networks can be created and updated for managed infrastructure.
Microsoft.Network/virtualNetworks/subnets/write	Management Group: Ironstone Managed	Subnets can be created and updated in managed virtual networks.
Microsoft.Network/virtualNetworks/subnets/join/action	Management Group: Ironstone Managed	Managed resources can be attached to required virtual network subnets.
Microsoft.Network/publicIPAddresses/write	Management Group: Ironstone Managed	Public IP addresses can be created and updated for managed network resources.
Microsoft.Network/publicIPAddresses/join/action	Management Group: Ironstone Managed	Public IP addresses can be associated with managed network resources.
Microsoft.Network/bastionHosts/write	Management Group: Ironstone Managed	Azure Bastion hosts can be created and updated for secure access to managed virtual machines.
Microsoft.Network/networkInterfaces/write	Management Group: Ironstone Managed	Network interfaces can be created and updated for managed virtual machines.
Microsoft.Network/networkInterfaces/join/action	Management Group: Ironstone Managed	Network interfaces can be attached to managed virtual machines and network resources.
Microsoft.RecoveryServices/Locations/backupStatus/action	Management Group: Ironstone Managed	Backup status can be checked to verify protection coverage for managed resources.
Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/protectedItems/recoveryPoints/restore/action	Management Group: Ironstone Managed	Managed resources can be restored from Recovery Services vault recovery points.
Microsoft.RecoveryServices/Vaults/backupFabrics/restore/action	Management Group: Ironstone Managed	Restore operations can be initiated from Recovery Services backup fabrics.
Microsoft.Resources/deploymentStacks/delete	Management Group: Ironstone Managed	Azure deployment stacks can be deleted during cleanup or decommissioning.
Microsoft.Authorization/policyAssignments/delete	Management Group: Ironstone Managed	Azure policy assignments can be deleted during cleanup or decommissioning.
Microsoft.Authorization/policyDefinitions/delete	Management Group: Ironstone Managed	Azure policy definitions can be deleted during cleanup or decommissioning.
Microsoft.Authorization/roleAssignments/delete	Management Group: Ironstone Managed	Role assignments that are no longer required can be removed from managed resources.
Microsoft.Authorization/roleDefinitions/delete	Management Group: Ironstone Managed	Custom role definitions can be deleted during cleanup or decommissioning.
Microsoft.DataProtection/*/delete	Management Group: Ironstone Managed	Azure Data Protection resources can be deleted during cleanup or decommissioning.
Microsoft.EventGrid/systemTopics/delete	Management Group: Ironstone Managed	Event Grid system topics can be deleted during cleanup or decommissioning.
Microsoft.EventGrid/systemTopics/eventSubscriptions/delete	Management Group: Ironstone Managed	Event Grid system topic subscriptions can be deleted during cleanup or decommissioning.
Microsoft.Insights/components/delete	Management Group: Ironstone Managed	Application Insights components can be deleted during cleanup or decommissioning.
Microsoft.Maintenance/maintenanceConfigurations/delete	Management Group: Ironstone Managed	Maintenance configurations can be deleted during cleanup or decommissioning.
Microsoft.Management/managementGroups/delete	Management Group: Ironstone Managed	Management groups created for managed services can be deleted during decommissioning.
Microsoft.RecoveryServices/vaults/delete	Management Group: Ironstone Managed	Recovery Services vaults can be deleted during cleanup or decommissioning.
Microsoft.RecoveryServices/vaults/backupPolicies/delete	Management Group: Ironstone Managed	Backup policies that are no longer required can be deleted.
Microsoft.RecoveryServices/vaults/backupResourceGuardProxies/delete	Management Group: Ironstone Managed	Backup resource guard proxies can be deleted during cleanup or decommissioning.
Microsoft.Storage/storageAccounts/delete	Management Group: Ironstone Managed	Storage accounts can be deleted during cleanup or decommissioning.
Microsoft.Storage/storageAccounts/blobServices/containers/delete	Management Group: Ironstone Managed	Storage blob containers can be deleted during cleanup or decommissioning.
Microsoft.Storage/storageAccounts/tableServices/tables/delete	Management Group: Ironstone Managed	Storage tables can be deleted during cleanup or decommissioning.
Microsoft.Web/serverfarms/delete	Management Group: Ironstone Managed	App Service plans can be deleted during cleanup or decommissioning.
Microsoft.Web/sites/delete	Management Group: Ironstone Managed	App Service and Function App resources can be deleted during cleanup or decommissioning.
Microsoft.CostManagement/scheduledActions/delete	Management Group: Ironstone Managed	Scheduled cost management actions that are no longer required can be deleted.
Microsoft.DataProtection/*/action		Enables Data Protection operations needed to configure and operate managed backup protection, including backup validation.
Microsoft.DataProtection/backupVaults/validateForBackup/action		Validates whether a resource can be protected before backup is configured in a Backup vault.
Microsoft.Compute/virtualMachines/start/action		Starts virtual machines as part of automated start/stop schedules and managed operational tasks.
Microsoft.Compute/virtualMachines/deallocate/action		Stops and deallocates virtual machines during automated shutdown, releasing compute resources to avoid unnecessary compute charges.
Microsoft.Compute/virtualMachines/powerOff/action		Powers off virtual machines when a managed workflow requires shutdown without deallocation.
Microsoft.Authorization/locks/write		Creates and updates resource locks to protect managed resources against accidental deletion or modification.
Microsoft.Network/networkSecurityPerimeters/write		Creates and updates Network Security Perimeters used to control network access to managed resources.
Microsoft.Network/networkSecurityPerimeters/*/write		Creates and updates perimeter child configuration, including profiles, access rules, and resource associations.
Microsoft.Network/networkSecurityPerimeters/profiles/accessRules/write		Creates and updates access rules defining permitted traffic for perimeter profiles.
Microsoft.Network/networkSecurityPerimeters/joinPerimeterRule/action		Authorizes the perimeter-rule join operation needed when configuring Network Security Perimeter connectivity.
Microsoft.Network/networkSecurityPerimeters/resourceAssociations/write		Creates and updates associations between managed resources and Network Security Perimeters.
Microsoft.Storage/storageAccounts/joinPerimeter/action		Allows managed storage accounts to be associated with a Network Security Perimeter.
Microsoft.Network/networkSecurityPerimeters/profiles/join/action		Allows managed resources to join a perimeter profile so its access rules can apply.

Your IT-systems permissions

Azure platform access