AuthorizationFailed creating Microsoft.Insights/monitoredObjects despite Owner + tenant-root permissions

Question

AuthorizationFailed creating Microsoft.Insights/monitoredObjects despite Owner + tenant-root permissions

Admin -AdviceLab 0

I'm setting up Azure Monitor Agent using the Windows client installer architecture (per Microsoft Learn: "Set up the Azure Monitor Agent on Windows client devices") to collect Critical-only Windows Event Logs into Microsoft Sentinel from ~200 Windows 11 client laptops.

This requires creating a tenant-level Monitored Object resource. Every attempt fails with AuthorizationFailed, regardless of permission level.

Command:

PUT https://management.azure.com/providers/Microsoft.Insights/monitoredObjects/{tenantId}?api-version=2021-09-01-preview

Body: { "properties": { "location": "australiacentral" } }

Error returned every time:

Forbidden({"error":{"code":"AuthorizationFailed","message":"The client does not have authorization to perform action 'Microsoft.Insights/monitoredObjects/write' over scope '/providers/Microsoft.Insights/monitoredObjects/{tenantId}' or the scope is invalid. If access was recently granted, please refresh your credentials."}})

Permissions confirmed in place simultaneously at time of failure:

Owner — directly on the target resource itself
Owner — at subscription scope
User Access Administrator — at tenant root scope (/)
Contributor — at Management Group (root) scope
Monitoring Contributor — at tenant root scope (/)

Already ruled out:

Resource provider registration confirmed (Microsoft.Insights shows monitoredObjects registered, api-version 2021-09-01-preview)
No Azure Policy deny assignments found (checked via az policy assignment list)
Request body format verified against Microsoft's documented reference script (properties wrapper included)
Retried after full token refresh / new Cloud Shell session — identical error every time

Is there a tenant-level feature flag, preview enrollment requirement, or regional restriction for Microsoft.Insights/monitoredObjects that would cause this independent of RBAC role assignments? Any guidance on how to check or request enablement would be appreciated.

Bharath Y P 10,530 Reputation points Microsoft External Staff Moderator

2026-08-29T17:34:48.5533333+00:00
Hello Admin-AdviceLab, Thank you for providing the detailed troubleshooting information and the permissions validation performed so far.

Based on our review, there is currently no publicly documented tenant-level feature flag, preview enrollment process, or regional allow-list requirement specific to the creation of Microsoft.Insights/monitoredObjects resources for the Azure Monitor Agent Windows client installer scenario. The documented implementation relies on creating a tenant-level Monitored Object resource and associating Data Collection Rules (DCRs) to it.

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client?tabs=cli%2Ccli-1

One area that requires further validation is the RBAC assignment at the tenant root scope (/). While the permissions shared include Owner at the subscription level, Contributor at the Management Group level, User Access Administrator at the tenant root scope, and Monitoring Contributor at the tenant root scope, the Monitored Object resource is created at the tenant/provider level (/providers/Microsoft.Insights/monitoredObjects/{tenantId}), and creation may require Owner permissions at the tenant root scope (/) rather than at the subscription or management group scope.

Could you please verify whether the account performing the operation has an Owner role assignment directly at the tenant root scope (/)? You can validate this using Azure PowerShell or Azure CLI and confirm whether the assignment is present.

Additionally, please confirm the following:

The tenant ID used in the Monitored Object resource path matches the tenant associated with the authenticated session.

The specified Monitored Object location aligns with the region used for the Data Collection Rule.

Whether a GET request against the Monitored Object endpoint succeeds or returns the same authorization error.

If Owner access is already assigned at the tenant root scope and the issue persists, the next step would be to engage the Azure Monitor engineering team for further investigation, as this may indicate a backend authorization or service-side issue rather than an RBAC configuration issue.

Once we receive the above validation results, we will be able to advise on the next steps accordingly. Thank you.

1 answer

Your answer

Answer 1

Dear @Admin -AdviceLab

The AuthorizationFailed on Microsoft.Insights/monitoredObjects/write for a tenant‑level monitored object is almost always a permissions/scope issue, not a regional or feature‑flag restriction. The monitored object is a tenant‑level ARM resource, so normal subscription Owner/Monitoring Contributor roles are not sufficient by themselves.

Key points:

A monitored object must be created at scope /providers/Microsoft.Insights/monitoredObjects/{tenantId}.

Microsoft’s docs state: “Because a monitored object is a tenant-level resource, the scope of permissions is greater than the scope of the permissions required for a subscription. An Azure tenant admin might be required to perform this step.”learn.microsoft

The recommended pattern is:
1. Elevate a Microsoft Entra tenant admin to “Azure tenant admin” (Owner at root /).
2. Assign the built‑in Monitored Object Contributor role (or equivalent custom role with Microsoft.Insights/monitoredObjects/write) at tenant root scope to the user/app that runs the PUT.

You can checkout by trying:

Use a Global Administrator account and enable “Elevate access” in Entra ID so that account has Owner at /. Then retry the PUT from that same identity.
Ensure the identity has Monitored Object Contributor (or a custom role including Microsoft.Insights/monitoredObjects/write) at tenant root (/), not just at subscription or management group.
Confirm you’re calling the API with the same tenant as the {tenantId} in the URL and that your token’s tid matches. A mismatch will cause AuthorizationFailed even with strong roles.
Wait a few minutes after new role assignments and refresh tokens (new Cloud Shell / az login) before retrying.

There is no documented regional restriction or preview enrollment flag specifically for monitoredObjects; the blocking factor in published cases is always tenant‑level RBAC.

References:

Set up the Azure Monitor Agent on Windows client devices (monitored object steps): https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-windows-client[learn.microsoft](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client)

Azure permissions for Monitor (includes Microsoft.Insights/MonitoredObjects/Write): https://docs.azure.cn/en-us/role-based-access-control/permissions/monitor[docs.azure](https://docs.azure.cn/en-us/role-based-access-control/permissions/monitor)

Community confirmation that tenant‑admin / elevated access is required for monitored object creation: https://learn.microsoft.com/en-gb/answers/questions/1009482/azure-monitor-agent-on-workstation[learn.microsoft](https://learn.microsoft.com/en-gb/answers/questions/1009482/azure-monitor-agent-on-workstation)

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.