> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cloud-onboarding-template-releases/cloud-onboarding-templates-azure-rn.md). # Azure ## 2026-10-20 ### ARM #### ADS * Narrowed the snapshot write permission to the scanning resource group, and broadened disk read access so snapshots can be copied. #### AUTOMATION * Added permissions for automation covering network firewalls, WAF and IP groups, Resource Graph, Log Analytics, SQL and PostgreSQL, AKS, and compute and storage management; account onboarding also gains data access to blobs, file shares, table entities, and Log Analytics queries. * Automation permissions can now be granted once at the management group instead of in every subscription. #### DISCOVERY * Removed Key Vault access from standard asset discovery; Key Vault discovery is now a separate, opt-in capability. #### DISCOVERY\_KEY\_VAULT * Added Key Vault asset discovery as a separate, opt-in capability. #### DSPM * Added discovery of self-managed databases (MongoDB, MySQL, MariaDB, SQL Server, and PostgreSQL) (Cloud-scan deployments only). * Fixed the scan interval for Azure Disks to match other data stores for account onboarding (Cloud-scan deployments only). #### POLICY * The compliance policy is now deployed only when Agentless Disk Scanning, DSPM, Kubernetes Security, or Key Vault asset discovery is enabled. * The compliance policy is no longer deployed for Entra ID only onboarding. #### REGISTRY * Registry scanning permissions can now be granted once at the management group instead of being applied to every subscription through the compliance policy. * Registry scanning permissions can now be granted once at the management group instead of being applied to every subscription through the compliance policy (Private registries). #### SERVERLESS * Serverless scanning permissions can now be granted once at the management group instead of being applied to every subscription through the compliance policy. * Serverless scanning permissions can now be granted once at the management group instead of being applied to every subscription through the compliance policy (Private serverless functions). #### GENERAL * Added an option to skip tenant approval, with the service principal created automatically. * Added an option to skip tenant approval, with the service principal created automatically (Entra ID only). * Removed invalid permissions from the onboarding role, including an invalid Azure Front Door endpoint read permission. * Removed unused permissions from the onboarding role. * Separated the compliance policy from the base onboarding so it is deployed only when needed (organization and account group onboarding only). ### Terraform #### ADS * Narrowed the snapshot write permission to the scanning resource group, and broadened disk read access so snapshots can be copied. * Added creation of an image gallery for account onboarding. #### AUTOMATION * Added permissions for automation covering network firewalls, WAF and IP groups, Resource Graph, Log Analytics, SQL and PostgreSQL, AKS, and compute and storage management; account onboarding also gains data access to blobs, file shares, table entities, and Log Analytics queries. #### DISCOVERY * Removed Key Vault access from standard asset discovery; Key Vault discovery is now a separate, opt-in capability. #### DISCOVERY\_KEY\_VAULT * Added Key Vault asset discovery as a separate, opt-in capability (account onboarding only). #### DSPM * Added discovery of self-managed databases (MongoDB, MySQL, MariaDB, SQL Server, and PostgreSQL) (Cloud-scan deployments only). #### POLICY * The compliance policy is now deployed only when Agentless Disk Scanning, DSPM, Kubernetes Security, or Key Vault asset discovery is enabled. * The compliance policy is no longer deployed for Entra ID only onboarding. #### REGISTRY * Registry scanning permissions are now granted directly at the management group instead of through the compliance policy. * Registry scanning permissions are now granted directly at the management group instead of through the compliance policy (Private registries). #### SERVERLESS * Serverless scanning permissions are now granted directly instead of through the compliance policy. * Serverless scanning permissions are now granted directly at the management group instead of through the compliance policy (Private serverless functions). #### GENERAL * Added an option to skip tenant approval, with the service principal created automatically. * Added an option to skip tenant approval, with the service principal created automatically (Entra ID only). * Removed unused permissions from the onboarding role. * Removed invalid permissions from the onboarding role, including an invalid Azure Front Door endpoint read permission (account onboarding only). * Separated the compliance policy from the base onboarding so it is deployed only when needed (organization and account group onboarding only). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cloud-onboarding-template-releases/cloud-onboarding-templates-azure-rn.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.