> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/phase-2-platform-identity-and-base-role.md). # Phase 2: Platform Identity and Base Role This phase creates the always-required base role at the root management group scope. Because Azure RBAC inherits downwards, you only define and assign this role once to cover all child subscriptions. > **Note:** All Azure resources that support tags must include the following tags: `managed_by=paloaltonetworks` (default, always required) Any additional tags you configured in the Azure onboarding wizard in Cortex To add a tag to an Azure resource, use the tag flag in az commands: `--tags managed_by=paloaltonetworks =` ### 2.1 Grant Microsoft Graph API application permission to the Cortex service principal Required for tenant root management group only. Skip this section entirely for management group onboarding. Microsoft Graph API application permissions are required exclusively for tenant root management group onboarding. These permissions allow Cortex to inventory Microsoft Entra ID resources like users, groups, role assignments, sign-in policies, and audit logs. They are not required if you are onboarding at a specific management group scope. | Permission | Purpose | App Role ID | Cloud Env | | --------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------- | --------------- | | `Domain.Read.All` | Read domains | `dbb9058a-0e50-45d7-ae91-66909b5d4664` | All | | `IdentityProvider.Read.All` | Read identity providers | `e321f0bb-e7f7-481e-bb28-e3b0b32d4bd0` | All | | `Organization.Read.All` | Read organization information | `498476ce-e0fe-48b0-b801-37ba7e2685c6` | All | | `EntitlementManagement.Read.All` | Read all entitlement management resources | `c74fd47d-ed3c-45c3-9a9e-b8676de685d2` | All | | `User.Read.All` | Read all users' full profiles | `df021288-bdef-4463-88db-98f22de89214` | All | | `Policy.Read.AuthenticationMethod` | Read authentication method policies | `8e3bc81b-d2f3-4b7b-838c-32c88218d2f0` | All | | `GroupMember.Read.All` | Read all group memberships | `98830695-27a2-44f7-8c18-0c3ebc9698f6` | All | | `RoleManagement.Read.All` | Read role management data for all RBAC providers | `c7fbd983-d9aa-4fa7-84b8-17382c103bc4` | All | | `Group.Read.All` | Read all groups | `5b567255-7703-4780-807c-7be8301ae99b` | All | | `AuditLog.Read.All` | Read all audit log data | `b0afded3-3588-46d8-8b3d-9842eff778da` | All | | `Policy.Read.All` | Read your organization's policies | `246dd0d5-5bd0-4def-940b-0421030a5b68` | All | | `Directory.Read.All` | Read directory data | `7ab1d382-f21e-4acd-a863-ba3e13f7da61` | All | | `RoleAssignmentSchedule.Read.Directory` | Read all active role assignments and role schedules for your directory | `d5fe8ce8-684c-4c83-a52c-46e882ce4be1` | Commercial-only | For Azure Government, omit the last row {% code overflow="wrap" %} ```bash # REQUIRED: set the real Cortex service principal object ID before running the loop export CORTEX_OBJECT_ID="" # Resolve the Microsoft Graph SP once (well-known app ID, present in every tenant) GRAPH_SP_ID=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query id -o tsv) echo "GRAPH_SP_ID=${GRAPH_SP_ID}" echo "CORTEX_OBJECT_ID=${CORTEX_OBJECT_ID}" # Permissions to grant (by human-readable Graph appRole `value`) COMMON_PERMS=( "Domain.Read.All" "IdentityProvider.Read.All" "Organization.Read.All" "EntitlementManagement.Read.All" "User.Read.All" "Policy.Read.AuthenticationMethod" "GroupMember.Read.All" "RoleManagement.Read.All" "Group.Read.All" "AuditLog.Read.All" "Policy.Read.All" "Directory.Read.All" ) # Commercial-only: skip on Azure Government PUBLIC_ONLY_PERMS=( "RoleAssignmentSchedule.Read.Directory" ) # Combine. On Azure Government, leave PUBLIC_ONLY_PERMS out of the union. PERMS=("${COMMON_PERMS[@]}" "${PUBLIC_ONLY_PERMS[@]}") for PERM in "${PERMS[@]}"; do # Resolve the appRole ID for this permission by name ROLE_ID=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "appRoles[?value=='${PERM}'].id | [0]" -o tsv) if [ -z "${ROLE_ID}" ] || [ "${ROLE_ID}" = "None" ]; then echo "MISSING in this cloud: ${PERM}" continue fi BODY=$(printf '{"principalId": "%s", "resourceId": "%s", "appRoleId": "%s"}' "${CORTEX_OBJECT_ID}" "${GRAPH_SP_ID}" "${ROLE_ID}") OUT=$(az rest --method post --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${CORTEX_OBJECT_ID}/appRoleAssignments" --headers "Content-Type=application/json" --body "${BODY}" 2>&1) RC=$? if [ $RC -eq 0 ]; then echo "granted: ${PERM}" elif echo "${OUT}" | grep -q "Permission being assigned already exists"; then echo "exists: ${PERM}" else echo "FAILED: ${PERM}" echo " -> ${OUT}" fi done ``` {% endcode %} Where: `` is the Cortex service principal object ID in your tenant #### 2.1.2 Verify the assigned Microsoft Graph permissions Run the following to list the assigned Microsoft Graph permissions and validate that the permissions have all been assigned: {% code overflow="wrap" %} ```bash az rest --method get --uri "https://graph.microsoft.com/v1.0/servicePrincipals/${CORTEX_OBJECT_ID}/appRoleAssignments?\$select=appRoleId,resourceDisplayName" --query "value[?resourceDisplayName=='Microsoft Graph'].appRoleId" -o tsv | while read RID; do az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "appRoles[?id=='${RID}'].value | [0]" -o tsv done | sort ``` {% endcode %} ### 2.2 Create the Cortex-Platform-Base custom role (required) **Module:** Assets Discovery The Cortex-Platform-Base custom role combines wide-read access and specific control-plane action permissions that Cortex needs for inventory, discovery, networking, and configuration retrieval. {% code overflow="wrap" %} ```bash cat > /tmp/Cortex-Platform-Base.json << EOF { "Name": "", "IsCustom": true, "Description": "Cortex Platform base read access (*/read) plus all common control-plane action permissions for inventory, discovery, networking, and configuration retrieval.", "Actions": [ "*/read", "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action", "Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action", "Microsoft.Network/networkInterfaces/effectiveRouteTable/action", "Microsoft.Network/networkWatchers/read", "Microsoft.Network/networkWatchers/securityGroupView/action", "Microsoft.Storage/storageAccounts/listKeys/action", "Microsoft.Web/sites/config/list/action", "Microsoft.Advisor/configurations/read", "Microsoft.AlertsManagement/prometheusRuleGroups/read", "Microsoft.AlertsManagement/smartDetectorAlertRules/read", "Microsoft.AnalysisServices/servers/read", "Microsoft.ApiManagement/service/apis/diagnostics/read", "Microsoft.ApiManagement/service/apis/policies/read", "Microsoft.ApiManagement/service/apis/read", "Microsoft.ApiManagement/service/identityProviders/read", "Microsoft.ApiManagement/service/portalsettings/read", "Microsoft.ApiManagement/service/products/policies/read", "Microsoft.ApiManagement/service/products/read", "Microsoft.ApiManagement/service/read", "Microsoft.ApiManagement/service/tenant/read", "Microsoft.AppConfiguration/configurationStores/read", "Microsoft.Attestation/attestationProviders/read", "Microsoft.Authorization/locks/read", "Microsoft.Authorization/permissions/read", "Microsoft.Authorization/policyAssignments/read", "Microsoft.Authorization/policyDefinitions/read", "Microsoft.Authorization/roleAssignments/read", "Microsoft.Authorization/roleDefinitions/read", "Microsoft.Automation/automationAccounts/credentials/read", "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read", "Microsoft.Automation/automationAccounts/read", "Microsoft.Automation/automationAccounts/runbooks/read", "Microsoft.Automation/automationAccounts/variables/read", "Microsoft.AzureStackHCI/Clusters/Read", "Microsoft.Batch/batchAccounts/pools/read", "Microsoft.Batch/batchAccounts/read", "Microsoft.Blueprint/blueprints/read", "Microsoft.BotService/botServices/read", "Microsoft.Cache/redis/firewallRules/read", "Microsoft.Cache/redis/read", "Microsoft.Cache/redisEnterprise/read", "Microsoft.Cdn/profiles/afdendpoints/read", "Microsoft.Cdn/profiles/afdendpoints/routes/read", "Microsoft.Cdn/profiles/customdomains/read", "Microsoft.Cdn/profiles/endpoints/customdomains/read", "Microsoft.Cdn/profiles/endpoints/read", "Microsoft.Cdn/profiles/origingroups/read", "Microsoft.Cdn/profiles/read", "Microsoft.Cdn/profiles/securitypolicies/read", "Microsoft.CognitiveServices/accounts/read", "Microsoft.CognitiveServices/accounts/deployments/read", "Microsoft.CognitiveServices/accounts/raiPolicies/read", "Microsoft.CognitiveServices/models/read", "Microsoft.CognitiveServices/accounts/models/read", "Microsoft.Communication/CommunicationServices/Read", "Microsoft.Compute/availabilitySets/read", "Microsoft.Compute/cloudServices/read", "Microsoft.Compute/cloudServices/roleInstances/read", "Microsoft.Compute/diskEncryptionSets/read", "Microsoft.Compute/disks/read", "Microsoft.Compute/galleries/images/read", "Microsoft.Compute/galleries/read", "Microsoft.Compute/hostGroups/read", "Microsoft.Compute/snapshots/read", "Microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read", "Microsoft.Compute/virtualMachineScaleSets/publicIPAddresses/read", "Microsoft.Compute/virtualMachineScaleSets/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipConfigurations/publicIPAddresses/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read", "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read", "Microsoft.Compute/virtualMachines/extensions/read", "Microsoft.Compute/virtualMachines/instanceView/read", "Microsoft.Compute/virtualMachines/read", "Microsoft.ContainerInstance/containerGroups/read", "Microsoft.ContainerRegistry/registries/metadata/read", "Microsoft.ContainerRegistry/registries/pull/read", "Microsoft.ContainerRegistry/registries/read", "Microsoft.ContainerService/managedClusters/read", "Microsoft.DBforMariaDB/servers/firewallRules/read", "Microsoft.DBforMariaDB/servers/read", "Microsoft.DBforMySQL/flexibleServers/configurations/read", "Microsoft.DBforMySQL/flexibleServers/databases/read", "Microsoft.DBforMySQL/flexibleServers/firewallRules/read", "Microsoft.DBforMySQL/flexibleServers/read", "Microsoft.DBforMySQL/servers/firewallRules/read", "Microsoft.DBforMySQL/servers/read", "Microsoft.DBforMySQL/servers/virtualNetworkRules/read", "Microsoft.DBforPostgreSQL/flexibleServers/configurations/read", "Microsoft.DBforPostgreSQL/flexibleServers/databases/read", "Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read", "Microsoft.DBforPostgreSQL/flexibleServers/read", "Microsoft.Dashboard/grafana/read", "Microsoft.DataBoxEdge/dataBoxEdgeDevices/read", "Microsoft.DataFactory/datafactories/read", "Microsoft.DataFactory/factories/integrationruntimes/read", "Microsoft.DataFactory/factories/linkedservices/read", "Microsoft.DataFactory/factories/read", "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/read", "Microsoft.DataLakeAnalytics/accounts/firewallRules/read", "Microsoft.DataLakeAnalytics/accounts/read", "Microsoft.DataLakeAnalytics/accounts/storageAccounts/read", "Microsoft.DataMigration/services/read", "Microsoft.DataShare/accounts/read", "Microsoft.Databricks/accessConnectors/read", "Microsoft.Databricks/workspaces/read", "Microsoft.DesktopVirtualization/applicationgroups/read", "Microsoft.DesktopVirtualization/hostpools/read", "Microsoft.DesktopVirtualization/hostpools/sessionhostconfigurations/read", "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read", "Microsoft.DesktopVirtualization/workspaces/providers/Microsoft.Insights/diagnosticSettings/read", "Microsoft.DesktopVirtualization/workspaces/read", "Microsoft.Devices/iotHubs/read", "Microsoft.Devices/iotHubs/privateLinkResources/Read", "Microsoft.DocumentDB/cassandraClusters/read", "Microsoft.DocumentDB/databaseAccounts/read", "Microsoft.EventGrid/domains/privateLinkResources/read", "Microsoft.EventGrid/domains/read", "Microsoft.EventGrid/namespaces/read", "Microsoft.EventGrid/partnerNamespaces/read", "Microsoft.EventGrid/topics/privateLinkResources/read", "Microsoft.EventGrid/topics/read", "Microsoft.EventHub/Namespaces/PrivateEndpointConnections/read", "Microsoft.EventHub/clusters/read", "Microsoft.EventHub/namespaces/authorizationRules/read", "Microsoft.EventHub/namespaces/eventhubs/authorizationRules/read", "Microsoft.EventHub/namespaces/eventhubs/read", "Microsoft.EventHub/namespaces/ipfilterrules/read", "Microsoft.EventHub/namespaces/read", "Microsoft.EventHub/namespaces/virtualnetworkrules/read", "Microsoft.HDInsight/clusters/applications/read", "Microsoft.HDInsight/clusters/read", "Microsoft.HealthcareApis/workspaces/read", "Microsoft.HybridCompute/machines/read", "Microsoft.Insights/ActivityLogAlerts/read", "Microsoft.Insights/Components/read", "Microsoft.Insights/DataCollectionEndpoints/Read", "Microsoft.Insights/DataCollectionRules/Read", "Microsoft.Insights/LogProfiles/read", "Microsoft.Insights/metricAlerts/read", "Microsoft.Insights/actionGroups/read", "Microsoft.Insights/diagnosticSettings/read", "Microsoft.Insights/eventtypes/values/read", "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/privateLinkResources/read", "Microsoft.KeyVault/vaults/read", "Microsoft.Kusto/Clusters/Databases/read", "Microsoft.Kusto/Clusters/read", "Microsoft.LoadTestService/loadTests/read", "Microsoft.Logic/integrationAccounts/read", "Microsoft.Logic/workflows/read", "Microsoft.Logic/workflows/versions/read", "Microsoft.MachineLearningServices/workspaces/computes/read", "Microsoft.MachineLearningServices/workspaces/outboundRules/read", "Microsoft.MachineLearningServices/workspaces/read", "Microsoft.ManagedIdentity/userAssignedIdentities/read", "Microsoft.ManagedServices/marketplaceRegistrationDefinitions/read", "Microsoft.ManagedServices/registrationAssignments/read", "Microsoft.Management/managementGroups/descendants/read", "Microsoft.Management/managementGroups/read", "Microsoft.Management/managementGroups/subscriptions/read", "Microsoft.Maps/accounts/read", "Microsoft.Migrate/moveCollections/read", "Microsoft.NetApp/netAppAccounts/capacityPools/read", "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read", "Microsoft.NetApp/netAppAccounts/read", "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/read", "Microsoft.Network/applicationGateways/read", "Microsoft.Network/applicationSecurityGroups/read", "Microsoft.Network/azurefirewalls/read", "Microsoft.Network/bastionHosts/read", "Microsoft.Network/connections/read", "Microsoft.Network/ddosProtectionPlans/read", "Microsoft.Network/dnsZones/read", "Microsoft.Network/expressRouteCircuits/authorizations/read", "Microsoft.Network/expressRouteCircuits/peerings/connections/read", "Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read", "Microsoft.Network/expressRouteCircuits/peerings/read", "Microsoft.Network/expressRouteCircuits/read", "Microsoft.Network/expressRouteCrossConnections/peerings/read", "Microsoft.Network/expressRouteCrossConnections/read", "Microsoft.Network/expressRouteGateways/expressRouteConnections/read", "Microsoft.Network/expressRouteGateways/read", "Microsoft.Network/expressRoutePorts/authorizations/read", "Microsoft.Network/expressRoutePorts/links/read", "Microsoft.Network/expressRoutePorts/read", "Microsoft.Network/expressRoutePortsLocations/read", "Microsoft.Network/firewallPolicies/read", "Microsoft.Network/frontDoorWebApplicationFirewallPolicies/read", "Microsoft.Network/frontDoors/backendPools/read", "Microsoft.Network/frontDoors/frontendEndpoints/read", "Microsoft.Network/frontDoors/healthProbeSettings/read", "Microsoft.Network/frontDoors/loadBalancingSettings/read", "Microsoft.Network/frontDoors/read", "Microsoft.Network/frontDoors/routingRules/read", "Microsoft.Network/frontDoors/rulesEngines/read", "Microsoft.Network/loadBalancers/read", "Microsoft.Network/localnetworkgateways/read", "Microsoft.Network/locations/usages/read", "Microsoft.Network/natGateways/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkSecurityGroups/securityRules/read", "Microsoft.Network/p2sVpnGateways/read", "Microsoft.Network/privateDnsZones/ALL/read", "Microsoft.Network/privateDnsZones/read", "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read", "Microsoft.Network/privateEndpoints/read", "Microsoft.Network/privateLinkServices/read", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/publicIPPrefixes/read", "Microsoft.Network/routeFilters/read", "Microsoft.Network/routeFilters/routeFilterRules/read", "Microsoft.Network/routeTables/read", "Microsoft.Network/routeTables/routes/read", "Microsoft.Network/serviceEndpointPolicies/read", "Microsoft.Network/serviceEndpointPolicies/serviceEndpointPolicyDefinitions/read", "Microsoft.Network/trafficManagerProfiles/read", "Microsoft.Network/virtualNetworkGateways/read", "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/virtualNetworks/subnets/read", "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read", "Microsoft.Network/virtualWans/read", "Microsoft.Network/vpnServerConfigurations/read", "Microsoft.NotificationHubs/Namespaces/NotificationHubs/read", "Microsoft.NotificationHubs/Namespaces/read", "Microsoft.OperationalInsights/clusters/read", "Microsoft.OperationalInsights/querypacks/read", "Microsoft.OperationalInsights/workspaces/read", "Microsoft.OperationalInsights/workspaces/tables/read", "Microsoft.PowerBIDedicated/capacities/read", "Microsoft.PowerBIDedicated/servers/read", "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read", "Microsoft.RecoveryServices/vaults/read", "Microsoft.RecoveryServices/vaults/backupPolicies/read", "Microsoft.RedHatOpenShift/openShiftClusters/read", "Microsoft.Relay/Namespaces/read", "Microsoft.Resources/Resources/read", "Microsoft.Resources/subscriptions/providers/read", "Microsoft.Resources/subscriptions/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Resources/templateSpecs/read", "Microsoft.Search/searchServices/read", "Microsoft.Security/advancedThreatProtectionSettings/read", "Microsoft.Security/automations/read", "Microsoft.Security/iotSecuritySolutions/read", "Microsoft.Security/locations/jitNetworkAccessPolicies/read", "Microsoft.Security/locations/read", "Microsoft.Security/pricings/read", "Microsoft.Security/secureScores/read", "Microsoft.Security/securityContacts/read", "Microsoft.Security/settings/read", "Microsoft.Security/workspaceSettings/read", "Microsoft.ServiceBus/namespaces/authorizationRules/read", "Microsoft.ServiceBus/namespaces/networkrulesets/read", "Microsoft.ServiceBus/namespaces/privateEndpointConnections/read", "Microsoft.ServiceBus/namespaces/providers/Microsoft.Insights/diagnosticSettings/read", "Microsoft.ServiceBus/namespaces/queues/read", "Microsoft.ServiceBus/namespaces/read", "Microsoft.ServiceBus/namespaces/topics/read", "Microsoft.ServiceBus/namespaces/topics/subscriptions/read", "Microsoft.ServiceFabric/clusters/read", "Microsoft.SignalRService/SignalR/read", "Microsoft.SignalRService/webPubSub/read", "Microsoft.Solutions/applications/read", "Microsoft.Sql/managedInstances/databases/read", "Microsoft.Sql/managedInstances/databases/transparentDataEncryption/read", "Microsoft.Sql/managedInstances/encryptionProtector/Read", "Microsoft.Sql/managedInstances/read", "Microsoft.Sql/managedInstances/vulnerabilityAssessments/Read", "Microsoft.Sql/servers/administrators/read", "Microsoft.Sql/servers/auditingSettings/read", "Microsoft.Sql/servers/databases/auditingSettings/read", "Microsoft.Sql/servers/databases/dataMaskingPolicies/read", "Microsoft.Sql/servers/databases/dataMaskingPolicies/rules/read", "Microsoft.Sql/servers/databases/read", "Microsoft.Sql/servers/databases/securityAlertPolicies/read", "Microsoft.Sql/servers/databases/transparentDataEncryption/read", "Microsoft.Sql/servers/encryptionProtector/read", "Microsoft.Sql/servers/firewallRules/read", "Microsoft.Sql/servers/read", "Microsoft.Sql/servers/securityAlertPolicies/read", "Microsoft.Sql/servers/vulnerabilityAssessments/read", "Microsoft.SqlVirtualMachine/sqlVirtualMachines/read", "Microsoft.Storage/storageAccounts/blobServices/read", "Microsoft.Storage/storageAccounts/fileServices/read", "Microsoft.Storage/storageAccounts/fileServices/shares/read", "Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/read", "Microsoft.Storage/storageAccounts/queueServices/read", "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/tableServices/read", "Microsoft.StorageCache/Subscription/caches/read", "Microsoft.StorageCache/caches/read", "Microsoft.StorageMover/storageMovers/read", "Microsoft.StorageSync/storageSyncServices/privateLinkResources/read", "Microsoft.StorageSync/storageSyncServices/read", "Microsoft.StreamAnalytics/clusters/Read", "Microsoft.StreamAnalytics/streamingjobs/Read", "Microsoft.Subscription/Policies/default/read", "Microsoft.Synapse/privateLinkHubs/privateLinkResources/read", "Microsoft.Synapse/privateLinkHubs/read", "Microsoft.Synapse/workspaces/privateLinkResources/read", "Microsoft.Synapse/workspaces/read", "Microsoft.Synapse/workspaces/sparkConfigurations/read", "Microsoft.Synapse/workspaces/sqlPools/geoBackupPolicies/read", "Microsoft.Synapse/workspaces/sqlPools/read", "Microsoft.VideoIndexer/accounts/read", "Microsoft.Web/certificates/read", "Microsoft.Web/customApis/read", "Microsoft.Web/hostingEnvironments/Read", "Microsoft.Web/serverfarms/Read", "Microsoft.Web/sites/read", "Microsoft.Web/sites/basicPublishingCredentialsPolicies/Read", "Microsoft.Web/sites/config/read", "Microsoft.web/sites/config/appsettings/read", "Microsoft.Web/sites/privateEndpointConnections/Read", "Microsoft.Web/sites/slots/Read", "microsoft.web/serverfarms/sites/read", "Microsoft.Web/staticSites/Read", "microsoft.app/containerapps/read", "microsoft.monitor/accounts/read", "microsoft.network/virtualnetworkgateways/connections/read", "Microsoft.web/sites/functions/read", "Microsoft.AppPlatform/Spring/apps/read", "Microsoft.AppPlatform/Spring/read", "Microsoft.Chaos/experiments/read", "Microsoft.Confluent/organizations/Read", "Microsoft.DataLakeStore/accounts/firewallRules/read", "Microsoft.DataLakeStore/accounts/read", "Microsoft.DataLakeStore/accounts/trustedIdProviders/read", "Microsoft.DataLakeStore/accounts/virtualNetworkRules/read", "Microsoft.Datadog/monitors/read", "Microsoft.DevCenter/devcenters/read", "Microsoft.DevTestLab/schedules/read", "Microsoft.DigitalTwins/digitalTwinsInstances/read", "Microsoft.DomainRegistration/domains/Read", "Microsoft.Easm/workspaces/read", "Microsoft.Elastic/monitors/read", "Microsoft.HealthBot/healthBots/Read", "Microsoft.IoTCentral/IoTApps/read", "Microsoft.LabServices/labs/read", "Microsoft.NetworkFunction/azureTrafficCollectors/read", "Microsoft.Quantum/Workspaces/Read", "Microsoft.SaaS/applications/read", "Microsoft.VisualStudio/Account/Read", "Microsoft.Workloads/monitors/read", "Microsoft.Automanage/configurationProfiles/Read", "Microsoft.ApiManagement/service/authorizationServers/read", "Microsoft.ApiManagement/service/backends/read", "Microsoft.ApiManagement/service/caches/read", "Microsoft.ApiManagement/service/namedValues/read", "Microsoft.ApiManagement/service/openidConnectProviders/read", "Microsoft.ApiManagement/service/privateEndpointConnections/read", "Microsoft.ApiManagement/service/subscriptions/read", "Microsoft.ApiManagement/service/users/read", "Microsoft.App/managedEnvironments/read", "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/hybridRunbookWorkers/read", "Microsoft.Batch/batchAccounts/applications/read", "Microsoft.Cdn/profiles/endpoints/origins/read", "Microsoft.CertificateRegistration/certificateOrders/read", "Microsoft.Compute/proximityPlacementGroups/read", "Microsoft.Compute/restorePointCollections/read", "Microsoft.ContainerRegistry/registries/cacheRules/read", "Microsoft.DataProtection/backupVaults/backupInstances/read", "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read", "Microsoft.DataProtection/backupVaults/backupJobs/read", "Microsoft.DataProtection/backupVaults/backupPolicies/read", "Microsoft.DataProtection/backupVaults/read", "Microsoft.Devices/iotHubs/privateEndpointConnections/read", "Microsoft.EventGrid/domains/eventSubscriptions/read", "Microsoft.EventGrid/topics/eventSubscriptions/read", "Microsoft.HealthcareApis/workspaces/dicomservices/read", "Microsoft.HealthcareApis/workspaces/fhirservices/read", "Microsoft.HybridCompute/licenses/read", "Microsoft.HybridCompute/machines/licenseProfiles/read", "Microsoft.HybridCompute/privateLinkScopes/read", "Microsoft.Insights/workbooks/read", "Microsoft.IoTCentral/IoTApps/privateEndpointConnections/read", "Microsoft.Kubernetes/connectedClusters/read", "Microsoft.Kusto/clusters/databases/principalAssignments/read", "Microsoft.Kusto/clusters/managedPrivateEndpoints/read", "Microsoft.Kusto/clusters/principalAssignments/read", "Microsoft.Kusto/clusters/privateLinkResources/read", "Microsoft.LoadTestService/loadTests/outboundNetworkDependenciesEndpoints/read", "Microsoft.Network/locations/operations/read", "Microsoft.Network/networkManagers/networkGroups/read", "Microsoft.Network/networkManagers/networkGroups/staticMembers/read", "Microsoft.Network/networkManagers/read", "Microsoft.Network/networkManagers/securityAdminConfigurations/read", "Microsoft.Network/networkWatchers/flowLogs/read", "Microsoft.Network/virtualHubs/read", "Microsoft.OperationalInsights/workspaces/dataexports/read", "Microsoft.RecoveryServices/vaults/privateLinkResources/read", "Microsoft.RecoveryServices/vaults/replicationProtectedItems/read", "Microsoft.Web/connections/read", "Microsoft.Web/sites/publishxml/action" ], "DataActions": [], "NotActions": [], "NotDataActions": [], "AssignableScopes": [ "/providers/Microsoft.Management/managementGroups/" ] } EOF az role definition create --role-definition /tmp/Cortex-Platform-Base.json ``` {% endcode %} Where: * `` is your chosen role name (e.g. `Cortex-Platform-Base`) * `` is root management group name (or tenant ID for tenant root management group scope) ### 2.3 Assign Cortex-Platform-Base at the root management group scope (required) Azure RBAC automatically propagates this assignment to all current and future child subscriptions. {% code overflow="wrap" %} ```bash az role assignment create --role "" --assignee-object-id "" --assignee-principal-type ServicePrincipal --scope "/providers/Microsoft.Management/managementGroups/" ``` {% endcode %} Where: * `` is your chosen role name (e.g. `Cortex-Platform-Base`) * `` is the Cortex service principal object ID in your tenant * `` is root management group name (or tenant ID for tenant root management group scope) ### 2.4 Create the Cortex-Asset Discovery-Data custom role **Module:** Assets Discovery (data plane) This subscription-level custom role grants the Cortex service principal data-plane read access to Key Vault keys, certificates, and key rotation policies. Run this for each child subscription. {% code overflow="wrap" %} ```bash cat > /tmp/Cortex-AssetDiscovery-Data.json << EOF { "Name": "", "IsCustom": true, "Description": "Asset Discovery data-plane reads (Key Vault keys, certificates, key rotation policies). Defined at MG scope, assigned per child subscription.", "Actions": [], "DataActions": [ "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/certificates/read", "Microsoft.KeyVault/vaults/keyrotationpolicies/read" ], "NotActions": [], "NotDataActions": [], "AssignableScopes": [ "/providers/Microsoft.Management/managementGroups/" ] } EOF az role definition create --role-definition /tmp/Cortex-AssetDiscovery-Data.json ``` {% endcode %} Where: * `` is your chosen role name (e.g. `Cortex-Asset Discovery-Data`) * `` is the root management group name (or tenant ID for tenant root management group scope) ### 2.5 Assign Cortex-AssetDiscovery-Data (per child subscription) **Module:** Assets Discovery (data plane) Execute this role assignment across all targeted child subscriptions. Doing so grants the Cortex service principal data-plane read permissions for Key Vault keys, certificates, and key rotation policies within each scope. {% code overflow="wrap" %} ```bash az account set --subscription "" az role assignment create --role "" --assignee-object-id "" --assignee-principal-type ServicePrincipal --scope "/subscriptions/" ``` {% endcode %} Where: * `` is the ID of the child subscription * `` is your chosen role name (e.g. `Cortex-Asset Discovery-Data`) * `` is the Cortex service principal object ID in your tenant *** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-management-group-or-tenant-scope/phase-2-platform-identity-and-base-role.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.