> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-2-platform-identity-and-base-role.md). # Phase 2: Platform Identity and Base Role This phase creates the shared resource group and the always-required base role that the Cortex service principal uses to read your subscription. Note: All Azure resources that support tags must include the following tags: * `managed_by=paloaltonetworks` (default, always required) * Any additional tags you configured in the Azure onboarding wizard in Cortex To add a tag to an Azure resource, use the tag flag in az commands: ```shell --tags managed_by=paloaltonetworks = ``` ### 2.1 Create the shared resource group (Required) All Cortex-managed resources are provisioned in a single resource group so that cleanup can be performed using a single az group delete command. ```shell az group create \ --name "" \ --location "" \ --tags managed_by=paloaltonetworks ``` Where: * `` is your chosen resource group name (e.g. cortex-platform-rg) * `` is the Azure region where you want to create your resource group (e.g. eastus) ### 2.2 Create the Cortex-Platform-Base custom role (Required) Module: Assets Discovery The Cortex-Platform-Base custom role combines wide-read access and specific control-plane action permissions that Cortex needs for inventory, discovery, networking, and configuration retrieval. ```shell cat > /tmp/Cortex-Platform-Base.json << EOF { "Name": "", "IsCustom": true, "Description": "Cortex Platform base read access (*/read) plus all common control-plane action permissions for inventory, discovery, networking, and configuration retrieval.", "Actions": [ "*/read", "Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action", "Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action", "Microsoft.Network/networkInterfaces/effectiveRouteTable/action", "Microsoft.Network/networkWatchers/read", "Microsoft.Network/networkWatchers/securityGroupView/action", "Microsoft.Storage/storageAccounts/listKeys/action", "Microsoft.Web/sites/config/list/action", "Microsoft.Advisor/configurations/read", "Microsoft.AlertsManagement/prometheusRuleGroups/read", "Microsoft.AlertsManagement/smartDetectorAlertRules/read", "Microsoft.AnalysisServices/servers/read", "Microsoft.ApiManagement/service/apis/diagnostics/read", "Microsoft.ApiManagement/service/apis/policies/read", "Microsoft.ApiManagement/service/apis/read", "Microsoft.ApiManagement/service/identityProviders/read", "Microsoft.ApiManagement/service/portalsettings/read", "Microsoft.ApiManagement/service/products/policies/read", "Microsoft.ApiManagement/service/products/read", "Microsoft.ApiManagement/service/read", "Microsoft.ApiManagement/service/tenant/read", "Microsoft.AppConfiguration/configurationStores/read", "Microsoft.Attestation/attestationProviders/read", "Microsoft.Authorization/locks/read", "Microsoft.Authorization/permissions/read", "Microsoft.Authorization/policyAssignments/read", "Microsoft.Authorization/policyDefinitions/read", "Microsoft.Authorization/roleAssignments/read", "Microsoft.Authorization/roleDefinitions/read", "Microsoft.Automation/automationAccounts/credentials/read", "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/read", "Microsoft.Automation/automationAccounts/read", "Microsoft.Automation/automationAccounts/runbooks/read", "Microsoft.Automation/automationAccounts/variables/read", "Microsoft.AzureStackHCI/Clusters/Read", "Microsoft.Batch/batchAccounts/pools/read", "Microsoft.Batch/batchAccounts/read", "Microsoft.Blueprint/blueprints/read", "Microsoft.BotService/botServices/read", "Microsoft.Cache/redis/firewallRules/read", "Microsoft.Cache/redis/read", "Microsoft.Cache/redisEnterprise/read", "Microsoft.Cdn/profiles/afdendpoints/read", "Microsoft.Cdn/profiles/afdendpoints/routes/read", "Microsoft.Cdn/profiles/customdomains/read", "Microsoft.Cdn/profiles/endpoints/customdomains/read", "Microsoft.Cdn/profiles/endpoints/read", "Microsoft.Cdn/profiles/origingroups/read", "Microsoft.Cdn/profiles/read", "Microsoft.Cdn/profiles/securitypolicies/read", "Microsoft.CognitiveServices/accounts/read", "Microsoft.CognitiveServices/accounts/deployments/read", "Microsoft.CognitiveServices/accounts/raiPolicies/read", "Microsoft.CognitiveServices/models/read", "Microsoft.CognitiveServices/accounts/models/read", "Microsoft.Communication/CommunicationServices/Read", "Microsoft.Compute/availabilitySets/read", "Microsoft.Compute/cloudServices/read", "Microsoft.Compute/cloudServices/roleInstances/read", "Microsoft.Compute/diskEncryptionSets/read", "Microsoft.Compute/disks/read", "Microsoft.Compute/galleries/images/read", "Microsoft.Compute/galleries/read", "Microsoft.Compute/hostGroups/read", "Microsoft.Compute/snapshots/read", "Microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read", "Microsoft.Compute/virtualMachineScaleSets/publicIPAddresses/read", "Microsoft.Compute/virtualMachineScaleSets/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipConfigurations/publicIPAddresses/read", "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read", "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read", "Microsoft.Compute/virtualMachines/extensions/read", "Microsoft.Compute/virtualMachines/instanceView/read", "Microsoft.Compute/virtualMachines/read", "Microsoft.ContainerInstance/containerGroups/read", "Microsoft.ContainerRegistry/registries/metadata/read", "Microsoft.ContainerRegistry/registries/pull/read", "Microsoft.ContainerRegistry/registries/read", "Microsoft.ContainerService/managedClusters/read", "Microsoft.DBforMariaDB/servers/firewallRules/read", "Microsoft.DBforMariaDB/servers/read", "Microsoft.DBforMySQL/flexibleServers/configurations/read", "Microsoft.DBforMySQL/flexibleServers/databases/read", "Microsoft.DBforMySQL/flexibleServers/firewallRules/read", "Microsoft.DBforMySQL/flexibleServers/read", "Microsoft.DBforMySQL/servers/firewallRules/read", "Microsoft.DBforMySQL/servers/read", "Microsoft.DBforMySQL/servers/virtualNetworkRules/read", "Microsoft.DBforPostgreSQL/flexibleServers/configurations/read", "Microsoft.DBforPostgreSQL/flexibleServers/databases/read", "Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read", "Microsoft.DBforPostgreSQL/flexibleServers/read", "Microsoft.Dashboard/grafana/read", "Microsoft.DataBoxEdge/dataBoxEdgeDevices/read", "Microsoft.DataFactory/datafactories/read", "Microsoft.DataFactory/factories/integrationruntimes/read", "Microsoft.DataFactory/factories/linkedservices/read", "Microsoft.DataFactory/factories/read", "Microsoft.DataLakeAnalytics/accounts/dataLakeStoreAccounts/read", "Microsoft.DataLakeAnalytics/accounts/firewallRules/read", "Microsoft.DataLakeAnalytics/accounts/read", "Microsoft.DataLakeAnalytics/accounts/storageAccounts/read", "Microsoft.DataMigration/services/read", "Microsoft.DataShare/accounts/read", "Microsoft.Databricks/accessConnectors/read", "Microsoft.Databricks/workspaces/read", "Microsoft.DesktopVirtualization/applicationgroups/read", "Microsoft.DesktopVirtualization/hostpools/read", "Microsoft.DesktopVirtualization/hostpools/sessionhostconfigurations/read", "Microsoft.DesktopVirtualization/hostpools/sessionhosts/read", "Microsoft.DesktopVirtualization/workspaces/providers/Microsoft.Insights/diagnosticSettings/read", "Microsoft.DesktopVirtualization/workspaces/read", "Microsoft.Devices/iotHubs/read", "Microsoft.Devices/iotHubs/privateLinkResources/Read", "Microsoft.DocumentDB/cassandraClusters/read", "Microsoft.DocumentDB/databaseAccounts/read", "Microsoft.EventGrid/domains/privateLinkResources/read", "Microsoft.EventGrid/domains/read", "Microsoft.EventGrid/namespaces/read", "Microsoft.EventGrid/partnerNamespaces/read", "Microsoft.EventGrid/topics/privateLinkResources/read", "Microsoft.EventGrid/topics/read", "Microsoft.EventHub/Namespaces/PrivateEndpointConnections/read", "Microsoft.EventHub/clusters/read", "Microsoft.EventHub/namespaces/authorizationRules/read", "Microsoft.EventHub/namespaces/eventhubs/authorizationRules/read", "Microsoft.EventHub/namespaces/eventhubs/read", "Microsoft.EventHub/namespaces/ipfilterrules/read", "Microsoft.EventHub/namespaces/read", "Microsoft.EventHub/namespaces/virtualnetworkrules/read", "Microsoft.HDInsight/clusters/applications/read", "Microsoft.HDInsight/clusters/read", "Microsoft.HealthcareApis/workspaces/read", "Microsoft.HybridCompute/machines/read", "Microsoft.Insights/ActivityLogAlerts/read", "Microsoft.Insights/Components/read", "Microsoft.Insights/DataCollectionEndpoints/Read", "Microsoft.Insights/DataCollectionRules/Read", "Microsoft.Insights/LogProfiles/read", "Microsoft.Insights/metricAlerts/read", "Microsoft.Insights/actionGroups/read", "Microsoft.Insights/diagnosticSettings/read", "Microsoft.Insights/eventtypes/values/read", "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/privateLinkResources/read", "Microsoft.KeyVault/vaults/read", "Microsoft.Kusto/Clusters/Databases/read", "Microsoft.Kusto/Clusters/read", "Microsoft.LoadTestService/loadTests/read", "Microsoft.Logic/integrationAccounts/read", "Microsoft.Logic/workflows/read", "Microsoft.Logic/workflows/versions/read", "Microsoft.MachineLearningServices/workspaces/computes/read", "Microsoft.MachineLearningServices/workspaces/outboundRules/read", "Microsoft.MachineLearningServices/workspaces/read", "Microsoft.ManagedIdentity/userAssignedIdentities/read", "Microsoft.ManagedServices/marketplaceRegistrationDefinitions/read", "Microsoft.ManagedServices/registrationAssignments/read", "Microsoft.Management/managementGroups/descendants/read", "Microsoft.Management/managementGroups/read", "Microsoft.Management/managementGroups/subscriptions/read", "Microsoft.Maps/accounts/read", "Microsoft.Migrate/moveCollections/read", "Microsoft.NetApp/netAppAccounts/capacityPools/read", "Microsoft.NetApp/netAppAccounts/capacityPools/volumes/read", "Microsoft.NetApp/netAppAccounts/read", "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/read", "Microsoft.Network/applicationGateways/read", "Microsoft.Network/applicationSecurityGroups/read", "Microsoft.Network/azurefirewalls/read", "Microsoft.Network/bastionHosts/read", "Microsoft.Network/connections/read", "Microsoft.Network/ddosProtectionPlans/read", "Microsoft.Network/dnsZones/read", "Microsoft.Network/expressRouteCircuits/authorizations/read", "Microsoft.Network/expressRouteCircuits/peerings/connections/read", "Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read", "Microsoft.Network/expressRouteCircuits/peerings/read", "Microsoft.Network/expressRouteCircuits/read", "Microsoft.Network/expressRouteCrossConnections/peerings/read", "Microsoft.Network/expressRouteCrossConnections/read", "Microsoft.Network/expressRouteGateways/expressRouteConnections/read", "Microsoft.Network/expressRouteGateways/read", "Microsoft.Network/expressRoutePorts/authorizations/read", "Microsoft.Network/expressRoutePorts/links/read", "Microsoft.Network/expressRoutePorts/read", "Microsoft.Network/expressRoutePortsLocations/read", "Microsoft.Network/firewallPolicies/read", "Microsoft.Network/frontDoorWebApplicationFirewallPolicies/read", "Microsoft.Network/frontDoors/backendPools/read", "Microsoft.Network/frontDoors/frontendEndpoints/read", "Microsoft.Network/frontDoors/healthProbeSettings/read", "Microsoft.Network/frontDoors/loadBalancingSettings/read", "Microsoft.Network/frontDoors/read", "Microsoft.Network/frontDoors/routingRules/read", "Microsoft.Network/frontDoors/rulesEngines/read", "Microsoft.Network/loadBalancers/read", "Microsoft.Network/localnetworkgateways/read", "Microsoft.Network/locations/usages/read", "Microsoft.Network/natGateways/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkSecurityGroups/defaultSecurityRules/read", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkSecurityGroups/securityRules/read", "Microsoft.Network/p2sVpnGateways/read", "Microsoft.Network/privateDnsZones/ALL/read", "Microsoft.Network/privateDnsZones/read", "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/read", "Microsoft.Network/privateEndpoints/read", "Microsoft.Network/privateLinkServices/read", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/publicIPPrefixes/read", "Microsoft.Network/routeFilters/read", "Microsoft.Network/routeFilters/routeFilterRules/read", "Microsoft.Network/routeTables/read", "Microsoft.Network/routeTables/routes/read", "Microsoft.Network/serviceEndpointPolicies/read", "Microsoft.Network/serviceEndpointPolicies/serviceEndpointPolicyDefinitions/read", "Microsoft.Network/trafficManagerProfiles/read", "Microsoft.Network/virtualNetworkGateways/read", "Microsoft.Network/virtualNetworks/read", "Microsoft.Network/virtualNetworks/subnets/read", "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read", "Microsoft.Network/virtualWans/read", "Microsoft.Network/vpnServerConfigurations/read", "Microsoft.NotificationHubs/Namespaces/NotificationHubs/read", "Microsoft.NotificationHubs/Namespaces/read", "Microsoft.OperationalInsights/clusters/read", "Microsoft.OperationalInsights/querypacks/read", "Microsoft.OperationalInsights/workspaces/read", "Microsoft.OperationalInsights/workspaces/tables/read", "Microsoft.PowerBIDedicated/capacities/read", "Microsoft.PowerBIDedicated/servers/read", "Microsoft.RecoveryServices/Vaults/backupProtectedItems/read", "Microsoft.RecoveryServices/vaults/read", "Microsoft.RecoveryServices/vaults/backupPolicies/read", "Microsoft.RedHatOpenShift/openShiftClusters/read", "Microsoft.Relay/Namespaces/read", "Microsoft.Resources/Resources/read", "Microsoft.Resources/subscriptions/providers/read", "Microsoft.Resources/subscriptions/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Resources/templateSpecs/read", "Microsoft.Search/searchServices/read", "Microsoft.Security/advancedThreatProtectionSettings/read", "Microsoft.Security/automations/read", "Microsoft.Security/iotSecuritySolutions/read", "Microsoft.Security/locations/jitNetworkAccessPolicies/read", "Microsoft.Security/locations/read", "Microsoft.Security/pricings/read", "Microsoft.Security/secureScores/read", "Microsoft.Security/securityContacts/read", "Microsoft.Security/settings/read", "Microsoft.Security/workspaceSettings/read", "Microsoft.ServiceBus/namespaces/authorizationRules/read", "Microsoft.ServiceBus/namespaces/networkrulesets/read", "Microsoft.ServiceBus/namespaces/privateEndpointConnections/read", "Microsoft.ServiceBus/namespaces/providers/Microsoft.Insights/diagnosticSettings/read", "Microsoft.ServiceBus/namespaces/queues/read", "Microsoft.ServiceBus/namespaces/read", "Microsoft.ServiceBus/namespaces/topics/read", "Microsoft.ServiceBus/namespaces/topics/subscriptions/read", "Microsoft.ServiceFabric/clusters/read", "Microsoft.SignalRService/SignalR/read", "Microsoft.SignalRService/webPubSub/read", "Microsoft.Solutions/applications/read", "Microsoft.Sql/managedInstances/databases/read", "Microsoft.Sql/managedInstances/databases/transparentDataEncryption/read", "Microsoft.Sql/managedInstances/encryptionProtector/Read", "Microsoft.Sql/managedInstances/read", "Microsoft.Sql/managedInstances/vulnerabilityAssessments/Read", "Microsoft.Sql/servers/administrators/read", "Microsoft.Sql/servers/auditingSettings/read", "Microsoft.Sql/servers/databases/auditingSettings/read", "Microsoft.Sql/servers/databases/dataMaskingPolicies/read", "Microsoft.Sql/servers/databases/dataMaskingPolicies/rules/read", "Microsoft.Sql/servers/databases/read", "Microsoft.Sql/servers/databases/securityAlertPolicies/read", "Microsoft.Sql/servers/databases/transparentDataEncryption/read", "Microsoft.Sql/servers/encryptionProtector/read", "Microsoft.Sql/servers/firewallRules/read", "Microsoft.Sql/servers/read", "Microsoft.Sql/servers/securityAlertPolicies/read", "Microsoft.Sql/servers/vulnerabilityAssessments/read", "Microsoft.SqlVirtualMachine/sqlVirtualMachines/read", "Microsoft.Storage/storageAccounts/blobServices/read", "Microsoft.Storage/storageAccounts/fileServices/read", "Microsoft.Storage/storageAccounts/fileServices/shares/read", "Microsoft.Storage/storageAccounts/providers/Microsoft.Insights/diagnosticSettings/read", "Microsoft.Storage/storageAccounts/queueServices/read", "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/tableServices/read", "Microsoft.StorageCache/Subscription/caches/read", "Microsoft.StorageCache/caches/read", "Microsoft.StorageMover/storageMovers/read", "Microsoft.StorageSync/storageSyncServices/privateLinkResources/read", "Microsoft.StorageSync/storageSyncServices/read", "Microsoft.StreamAnalytics/clusters/Read", "Microsoft.StreamAnalytics/streamingjobs/Read", "Microsoft.Subscription/Policies/default/read", "Microsoft.Synapse/privateLinkHubs/privateLinkResources/read", "Microsoft.Synapse/privateLinkHubs/read", "Microsoft.Synapse/workspaces/privateLinkResources/read", "Microsoft.Synapse/workspaces/read", "Microsoft.Synapse/workspaces/sparkConfigurations/read", "Microsoft.Synapse/workspaces/sqlPools/geoBackupPolicies/read", "Microsoft.Synapse/workspaces/sqlPools/read", "Microsoft.VideoIndexer/accounts/read", "Microsoft.Web/certificates/read", "Microsoft.Web/customApis/read", "Microsoft.Web/hostingEnvironments/Read", "Microsoft.Web/serverfarms/Read", "Microsoft.Web/sites/read", "Microsoft.Web/sites/basicPublishingCredentialsPolicies/Read", "Microsoft.Web/sites/config/read", "Microsoft.web/sites/config/appsettings/read", "Microsoft.Web/sites/privateEndpointConnections/Read", "Microsoft.Web/sites/slots/Read", "microsoft.web/serverfarms/sites/read", "Microsoft.Web/staticSites/Read", "microsoft.app/containerapps/read", "microsoft.monitor/accounts/read", "microsoft.network/virtualnetworkgateways/connections/read", "Microsoft.web/sites/functions/read", "Microsoft.AppPlatform/Spring/apps/read", "Microsoft.AppPlatform/Spring/read", "Microsoft.Chaos/experiments/read", "Microsoft.Confluent/organizations/Read", "Microsoft.DataLakeStore/accounts/firewallRules/read", "Microsoft.DataLakeStore/accounts/read", "Microsoft.DataLakeStore/accounts/trustedIdProviders/read", "Microsoft.DataLakeStore/accounts/virtualNetworkRules/read", "Microsoft.Datadog/monitors/read", "Microsoft.DevCenter/devcenters/read", "Microsoft.DevTestLab/schedules/read", "Microsoft.DigitalTwins/digitalTwinsInstances/read", "Microsoft.DomainRegistration/domains/Read", "Microsoft.Easm/workspaces/read", "Microsoft.Elastic/monitors/read", "Microsoft.HealthBot/healthBots/Read", "Microsoft.IoTCentral/IoTApps/read", "Microsoft.LabServices/labs/read", "Microsoft.NetworkFunction/azureTrafficCollectors/read", "Microsoft.Quantum/Workspaces/Read", "Microsoft.SaaS/applications/read", "Microsoft.VisualStudio/Account/Read", "Microsoft.Workloads/monitors/read", "Microsoft.Automanage/configurationProfiles/Read", "Microsoft.ApiManagement/service/authorizationServers/read", "Microsoft.ApiManagement/service/backends/read", "Microsoft.ApiManagement/service/caches/read", "Microsoft.ApiManagement/service/namedValues/read", "Microsoft.ApiManagement/service/openidConnectProviders/read", "Microsoft.ApiManagement/service/privateEndpointConnections/read", "Microsoft.ApiManagement/service/subscriptions/read", "Microsoft.ApiManagement/service/users/read", "Microsoft.App/managedEnvironments/read", "Microsoft.Automation/automationAccounts/hybridRunbookWorkerGroups/hybridRunbookWorkers/read", "Microsoft.Batch/batchAccounts/applications/read", "Microsoft.Cdn/profiles/endpoints/origins/read", "Microsoft.CertificateRegistration/certificateOrders/read", "Microsoft.Compute/proximityPlacementGroups/read", "Microsoft.Compute/restorePointCollections/read", "Microsoft.ContainerRegistry/registries/cacheRules/read", "Microsoft.DataProtection/backupVaults/backupInstances/read", "Microsoft.DataProtection/backupVaults/backupInstances/recoveryPoints/read", "Microsoft.DataProtection/backupVaults/backupJobs/read", "Microsoft.DataProtection/backupVaults/backupPolicies/read", "Microsoft.DataProtection/backupVaults/read", "Microsoft.Devices/iotHubs/privateEndpointConnections/read", "Microsoft.EventGrid/domains/eventSubscriptions/read", "Microsoft.EventGrid/topics/eventSubscriptions/read", "Microsoft.HealthcareApis/workspaces/dicomservices/read", "Microsoft.HealthcareApis/workspaces/fhirservices/read", "Microsoft.HybridCompute/licenses/read", "Microsoft.HybridCompute/machines/licenseProfiles/read", "Microsoft.HybridCompute/privateLinkScopes/read", "Microsoft.Insights/workbooks/read", "Microsoft.IoTCentral/IoTApps/privateEndpointConnections/read", "Microsoft.Kubernetes/connectedClusters/read", "Microsoft.Kusto/clusters/databases/principalAssignments/read", "Microsoft.Kusto/clusters/managedPrivateEndpoints/read", "Microsoft.Kusto/clusters/principalAssignments/read", "Microsoft.Kusto/clusters/privateLinkResources/read", "Microsoft.LoadTestService/loadTests/outboundNetworkDependenciesEndpoints/read", "Microsoft.Network/locations/operations/read", "Microsoft.Network/networkManagers/networkGroups/read", "Microsoft.Network/networkManagers/networkGroups/staticMembers/read", "Microsoft.Network/networkManagers/read", "Microsoft.Network/networkManagers/securityAdminConfigurations/read", "Microsoft.Network/networkWatchers/flowLogs/read", "Microsoft.Network/virtualHubs/read", "Microsoft.OperationalInsights/workspaces/dataexports/read", "Microsoft.RecoveryServices/vaults/privateLinkResources/read", "Microsoft.RecoveryServices/vaults/replicationProtectedItems/read", "Microsoft.Web/connections/read", "Microsoft.Web/sites/publishxml/action" ], "DataActions": [ "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/certificates/read", "Microsoft.KeyVault/vaults/keyrotationpolicies/read" ], "NotActions": [], "NotDataActions": [], "AssignableScopes": [ "/subscriptions/" ] } EOF az role definition create --role-definition /tmp/Cortex-Platform-Base.json ``` Where: * `` is your chosen role name (e.g. Cortex-Platform-Base) * `` is your subscription ID ### 2.3 Assign Cortex-Platform-Base to the Cortex service principal (required) ```shell az role assignment create \ --role "" \ --assignee-object-id "" \ --assignee-principal-type ServicePrincipal \ --scope "/subscriptions/" ``` Where: * `` is your chosen role name (e.g. Cortex-Platform-Base) * `` is the Cortex service principal object ID, obtained from the identifiers file * `` is your subscription ID --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/microsoft-azure-manual-onboarding/azure-manual-onboarding-guide/azure-manual-onboarding-subscription-scope/phase-2-platform-identity-and-base-role.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.