# Required Azure permissions > An Azure resource handler acts as the Microsoft Entra ID application you registered, so that application needs a role on the subscription --- Site [llms.txt](/llms.txt) --- Cloud Management Platform (CMP) works entirely through Azure Resource Manager. Register the application as described in [Configure the Azure portal](/docs/cmp/configure/infrastructure/resource-handlers/azure/#before-you-begin), then assign it one of the roles below at subscription scope. A role scoped to individual resource groups cannot read what CMP needs from the subscription as a whole: existing servers to discover, available regions and virtual machine sizes, stored SSH public keys, and cost. ## Contributor Assign the built-in **Contributor** role to the application at subscription scope. It covers everything CMP does: creating and deleting virtual machines, disks, network interfaces, security groups, public IP addresses, storage accounts, availability sets, and resource groups; power actions; resizing; snapshots; load balancers; tagging; cost; and utilization metrics. ## Reader, to import and monitor only If CMP should only import and monitor existing Azure servers, with no provisioning, power actions, resizing, or deletion, assign **Reader**, as well as: - `Microsoft.Commerce/RateCard/read`, for cost. - `Microsoft.Insights/metrics/read`, for utilization. ## A custom role, for least privilege If your security policy requires least privilege, create a role containing only the actions CMP calls. It covers connection checks, discovery, region and image lookups, provisioning, power and resize, disks and snapshots, load balancers, tagging, deletion, cost, and metrics. 1. Save the following as `Azure_CloudBolt_ARM_Role.json`, replacing `SUBSCRIPTION_ID` with your subscription ID. ```json { "Name": "CloudBolt ARM Operator", "IsCustom": true, "Description": "Minimum permissions for the CloudBolt CMP Azure resource handler.", "Actions": [ "Microsoft.Resources/subscriptions/read", "Microsoft.Resources/subscriptions/locations/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Resources/subscriptions/resourceGroups/write", "Microsoft.Resources/subscriptions/resourceGroups/delete", "Microsoft.Resources/subscriptions/resourceGroups/resources/read", "Microsoft.Resources/deployments/read", "Microsoft.Resources/deployments/write", "Microsoft.Resources/deployments/operations/read", "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachines/write", "Microsoft.Compute/virtualMachines/delete", "Microsoft.Compute/virtualMachines/start/action", "Microsoft.Compute/virtualMachines/powerOff/action", "Microsoft.Compute/virtualMachines/deallocate/action", "Microsoft.Compute/virtualMachines/restart/action", "Microsoft.Compute/virtualMachines/runCommand/action", "Microsoft.Compute/virtualMachines/vmSizes/read", "Microsoft.Compute/virtualMachines/extensions/read", "Microsoft.Compute/virtualMachines/extensions/write", "Microsoft.Compute/virtualMachineScaleSets/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read", "Microsoft.Compute/availabilitySets/read", "Microsoft.Compute/availabilitySets/write", "Microsoft.Compute/availabilitySets/delete", "Microsoft.Compute/disks/read", "Microsoft.Compute/disks/write", "Microsoft.Compute/disks/delete", "Microsoft.Compute/snapshots/read", "Microsoft.Compute/snapshots/write", "Microsoft.Compute/snapshots/delete", "Microsoft.Compute/images/read", "Microsoft.Compute/galleries/read", "Microsoft.Compute/galleries/images/read", "Microsoft.Compute/galleries/images/versions/read", "Microsoft.Compute/sshPublicKeys/read", "Microsoft.Compute/locations/vmSizes/read", "Microsoft.Compute/locations/publishers/read", "Microsoft.Compute/locations/publishers/artifacttypes/offers/read", "Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/read", "Microsoft.Compute/locations/publishers/artifacttypes/offers/skus/versions/read", "Microsoft.Compute/locations/publishers/artifacttypes/types/versions/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkInterfaces/write", "Microsoft.Network/networkInterfaces/delete", "Microsoft.Network/networkInterfaces/join/action", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/publicIPAddresses/write", "Microsoft.Network/publicIPAddresses/delete", "Microsoft.Network/publicIPAddresses/join/action", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkSecurityGroups/write", "Microsoft.Network/networkSecurityGroups/delete", "Microsoft.Network/networkSecurityGroups/join/action", "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/virtualNetworks/subnets/read", "Microsoft.Network/virtualNetworks/subnets/join/action", "Microsoft.Network/loadBalancers/read", "Microsoft.Network/loadBalancers/write", "Microsoft.Network/loadBalancers/delete", "Microsoft.Network/loadBalancers/backendAddressPools/read", "Microsoft.Network/loadBalancers/backendAddressPools/write", "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/write", "Microsoft.Storage/storageAccounts/delete", "Microsoft.Storage/storageAccounts/listKeys/action", "Microsoft.Storage/checkNameAvailability/read", "Microsoft.Commerce/RateCard/read", "Microsoft.Insights/metrics/read", "Microsoft.Insights/metricDefinitions/read" ], "NotActions": [], "DataActions": [], "NotDataActions": [], "AssignableScopes": [ "/subscriptions/SUBSCRIPTION_ID" ] } ``` 1. Create the role. ```bash az role definition create --role-definition Azure_CloudBolt_ARM_Role.json ``` 1. In the Azure portal, open the subscription, select **Access control (IAM)** > **Add role assignment**, and assign the new role to the application. ## Related - [Azure](/docs/cmp/configure/infrastructure/resource-handlers/azure/): register the application, then create the resource handler that uses it. - [Azure resource handler for multiple cloud subscriptions](/docs/cmp/configure/infrastructure/resource-handlers/azure/multiple-subscriptions/): assign a role across every subscription an application can reach.