Check Azure Monitor workspace access mode when resource-scoped metrics queries fail

Source facts

Microsoft explains that resource-scoped metric queries use Azure RBAC for the queried resources. Depending on the access-control mode of the Azure Monitor workspace storing those metrics, the caller may also need direct permission to that workspace. Query scope alone does not determine the complete access requirement. Microsoft Learn.

Applicability

Use this review for an Azure Monitor workspace metrics query made by an identified reader or automation principal. Record the queried resources, hosting workspace and actual query path. Keep Azure Monitor metric-workspace access distinct from Log Analytics workspace access and its log-specific controls.

DSE recommendation

DSE recommends inspecting the workspace’s access mode before adding broader resource roles to resolve a failed query. Have the workspace owner compare the intended access design with the caller’s current grants. Choose an approved query path and permission arrangement together. Preserve the existing access-mode setting while evaluating the effect on other consumers.

Verification

Test the intended resource-scoped query using the actual caller identity and record the workspace mode at that time. Confirm access to an approved resource and lack of access to an out-of-scope resource. If a workspace permission is added, inspect its full scope rather than assuming it is limited to the original query. Retain the resulting access decision and test evidence.

Official references

Microsoft Learn: Manage access to Azure Monitor workspaces.