{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/", "slug": "dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource", "url": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/" }, "title": "Scope diagnostic-destination ListKeys permission to the monitoring resource", "summary": "Review the destination permission required when creating a diagnostic setting.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:37+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 208, "potentially_affected": "Use this review for a named operator configuring a specific diagnostic destination. Identify the source resource, destination and existing inherited grants. A request to fix one monitoring operation should not silently become broad permission to obtain unrelated resource keys.", "dse_recommendation": "DSE recommends having the monitoring and destination owners review the exact missing permission together.", "primary_source": { "name": "Roles, permissions, and security in Azure Monitor - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/roles-permissions-security", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft states that creating or editing a diagnostic setting for a storage-account or Event Hubs destination requires ListKeys on that target in addition to Monitoring Contributor. The guidance places ListKeys at the resource or resource-group scope, rather than subscription scope for monitoring-only users. Microsoft Learn.

\n

Applicability

\n

Use this review for a named operator configuring a specific diagnostic destination. Identify the source resource, destination and existing inherited grants. A request to fix one monitoring operation should not silently become broad permission to obtain unrelated resource keys.

\n

DSE recommendation

\n

DSE recommends having the monitoring and destination owners review the exact missing permission together. Choose the smallest justified assignment scope and document its purpose, duration and removal owner. Treat access to destination keys as sensitive and review the complete source’s security considerations. Avoid displaying retrieved keys in support tickets while diagnosing the authorization path.

\n

Verification

\n

Test the approved diagnostic-setting operation against the intended destination using the operator’s actual identity. Check that data subsequently arrives where expected and that unrelated destinations remain outside the granted scope. Retain the role-assignment identifiers and sanitized operation result. Review inherited permissions as well as the new assignment before describing the access as limited.

\n

Official references

\n

Microsoft Learn: Roles, permissions, and security in Azure Monitor.

", "content_text": "Source facts\nMicrosoft states that creating or editing a diagnostic setting for a storage-account or Event Hubs destination requires ListKeys on that target in addition to Monitoring Contributor. The guidance places ListKeys at the resource or resource-group scope, rather than subscription scope for monitoring-only users. Microsoft Learn.\nApplicability\nUse this review for a named operator configuring a specific diagnostic destination. Identify the source resource, destination and existing inherited grants. A request to fix one monitoring operation should not silently become broad permission to obtain unrelated resource keys.\nDSE recommendation\nDSE recommends having the monitoring and destination owners review the exact missing permission together. Choose the smallest justified assignment scope and document its purpose, duration and removal owner. Treat access to destination keys as sensitive and review the complete source’s security considerations. Avoid displaying retrieved keys in support tickets while diagnosing the authorization path.\nVerification\nTest the approved diagnostic-setting operation against the intended destination using the operator’s actual identity. Check that data subsequently arrives where expected and that unrelated destinations remain outside the granted scope. Retain the role-assignment identifiers and sanitized operation result. Review inherited permissions as well as the new assignment before describing the access as limited.\nOfficial references\nMicrosoft Learn: Roles, permissions, and security in Azure Monitor.", "content_markdown": "## Source facts\n\nMicrosoft states that creating or editing a diagnostic setting for a storage-account or Event Hubs destination requires ListKeys on that target in addition to Monitoring Contributor. The guidance places ListKeys at the resource or resource-group scope, rather than subscription scope for monitoring-only users. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/roles-permissions-security).\n\n## Applicability\n\nUse this review for a named operator configuring a specific diagnostic destination. Identify the source resource, destination and existing inherited grants. A request to fix one monitoring operation should not silently become broad permission to obtain unrelated resource keys.\n\n## DSE recommendation\n\nDSE recommends having the monitoring and destination owners review the exact missing permission together. Choose the smallest justified assignment scope and document its purpose, duration and removal owner. Treat access to destination keys as sensitive and review the complete source’s security considerations. Avoid displaying retrieved keys in support tickets while diagnosing the authorization path.\n\n## Verification\n\nTest the approved diagnostic-setting operation against the intended destination using the operator’s actual identity. Check that data subsequently arrives where expected and that unrelated destinations remain outside the granted scope. Retain the role-assignment identifiers and sanitized operation result. Review inherited permissions as well as the new assignment before describing the access as limited.\n\n## Official references\n\n[Microsoft Learn: Roles, permissions, and security in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/roles-permissions-security)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/", "url": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Scope diagnostic-destination ListKeys permission to the monitoring resource", "item": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/", "url": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/", "headline": "Scope diagnostic-destination ListKeys permission to the monitoring resource", "description": "Review the destination permission required when creating a diagnostic setting.", "abstract": "Review the destination permission required when creating a diagnostic setting.", "articleBody": "Source facts\nMicrosoft states that creating or editing a diagnostic setting for a storage-account or Event Hubs destination requires ListKeys on that target in addition to Monitoring Contributor. The guidance places ListKeys at the resource or resource-group scope, rather than subscription scope for monitoring-only users. Microsoft Learn.\nApplicability\nUse this review for a named operator configuring a specific diagnostic destination. Identify the source resource, destination and existing inherited grants. A request to fix one monitoring operation should not silently become broad permission to obtain unrelated resource keys.\nDSE recommendation\nDSE recommends having the monitoring and destination owners review the exact missing permission together. Choose the smallest justified assignment scope and document its purpose, duration and removal owner. Treat access to destination keys as sensitive and review the complete source’s security considerations. Avoid displaying retrieved keys in support tickets while diagnosing the authorization path.\nVerification\nTest the approved diagnostic-setting operation against the intended destination using the operator’s actual identity. Check that data subsequently arrives where expected and that unrelated destinations remain outside the granted scope. Retain the role-assignment identifiers and sanitized operation result. Review inherited permissions as well as the new assignment before describing the access as limited.\nOfficial references\nMicrosoft Learn: Roles, permissions, and security in Azure Monitor.", "datePublished": "2026-09-17T16:33:37+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Scope diagnostic-destination ListKeys permission to the monitoring resource" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 208, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Roles, permissions, and security in Azure Monitor - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/roles-permissions-security" } } ] } }