# Scope diagnostic-destination ListKeys permission to the monitoring resource

> Review the destination permission required when creating a diagnostic setting.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:37+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Review the destination permission required when creating a diagnostic setting.

## Potentially affected

Use this review for a named operator configuring a specific diagnostic destination. Identify the source resource, destination and existing inherited grants. A request to fix one monitoring operation should not silently become broad permission to obtain unrelated resource keys.

## DSE recommendation

DSE recommends having the monitoring and destination owners review the exact missing permission together.

## Article

## Source facts

Microsoft states that creating or editing a diagnostic setting for a storage-account or Event Hubs destination requires ListKeys on that target in addition to Monitoring Contributor. The guidance places ListKeys at the resource or resource-group scope, rather than subscription scope for monitoring-only users. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/roles-permissions-security).

## Applicability

Use this review for a named operator configuring a specific diagnostic destination. Identify the source resource, destination and existing inherited grants. A request to fix one monitoring operation should not silently become broad permission to obtain unrelated resource keys.

## DSE recommendation

DSE recommends having the monitoring and destination owners review the exact missing permission together. Choose the smallest justified assignment scope and document its purpose, duration and removal owner. Treat access to destination keys as sensitive and review the complete source’s security considerations. Avoid displaying retrieved keys in support tickets while diagnosing the authorization path.

## Verification

Test the approved diagnostic-setting operation against the intended destination using the operator’s actual identity. Check that data subsequently arrives where expected and that unrelated destinations remain outside the granted scope. Retain the role-assignment identifiers and sanitized operation result. Review inherited permissions as well as the new assignment before describing the access as limited.

## Official references

[Microsoft Learn: Roles, permissions, and security in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/roles-permissions-security).

## Primary reference

- Name: Roles, permissions, and security in Azure Monitor - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/roles-permissions-security
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Scope diagnostic-destination ListKeys permission to the monitoring resource,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-083-scope-diagnostic-destination-listkeys-permission-to-the-monitoring-resource/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.