Scope diagnostic-destination ListKeys permission to the monitoring resource

Source facts

Microsoft states that creating or editing a diagnostic setting for a storage-account or Event Hubs destination requires ListKeys on that target in addition to Monitoring Contributor. The guidance places ListKeys at the resource or resource-group scope, rather than subscription scope for monitoring-only users. Microsoft Learn.

Applicability

Use this review for a named operator configuring a specific diagnostic destination. Identify the source resource, destination and existing inherited grants. A request to fix one monitoring operation should not silently become broad permission to obtain unrelated resource keys.

DSE recommendation

DSE recommends having the monitoring and destination owners review the exact missing permission together. Choose the smallest justified assignment scope and document its purpose, duration and removal owner. Treat access to destination keys as sensitive and review the complete source’s security considerations. Avoid displaying retrieved keys in support tickets while diagnosing the authorization path.

Verification

Test the approved diagnostic-setting operation against the intended destination using the operator’s actual identity. Check that data subsequently arrives where expected and that unrelated destinations remain outside the granted scope. Retain the role-assignment identifiers and sanitized operation result. Review inherited permissions as well as the new assignment before describing the access as limited.

Official references

Microsoft Learn: Roles, permissions, and security in Azure Monitor.