Common questions about permissions in Defender for Cloud

Microsoft Defender for Cloud uses Azure role-based access control (Azure RBAC), which provides built-in roles that can be assigned to users, groups, and services in Azure.

Defender for Cloud assesses the configuration of your resources to identify security issues and vulnerabilities. In Defender for Cloud, you only see information related to a resource when you're assigned the role of Owner, Contributor, or Reader for the subscription or resource group that a resource belongs to.

See Permissions in Microsoft Defender for Cloud to learn more about roles and allowed actions in Defender for Cloud.

To modify a security policy, you must be a Security Admin or an Owner or Contributor of that subscription.

To learn how to configure a security policy, see Setting security policies in Microsoft Defender for Cloud.

The roles and permissions used by Defender for Cloud to perform agentless scanning on your Azure, AWS, and GCP environments are listed here. In Azure, these permissions are automatically added to your subscriptions when you enable agentless scanning. In AWS, these permissions are added to the CloudFormation stack in your AWS connector and in GCP permissions are added to the onboarding script in your GCP connector.

• Azure permissions - The built-in role “VM scanner operator” has read-only permissions for VM disks that are required for the snapshot process. The detailed list of permissions is:

  • Microsoft.Compute/disks/read
  • Microsoft.Compute/disks/beginGetAccess/action
  • Microsoft.Compute/disks/diskEncryptionSets/read
  • Microsoft.Compute/virtualMachines/instanceView/read
  • Microsoft.Compute/virtualMachines/read
  • Microsoft.Compute/virtualMachineScaleSets/instanceView/read
  • Microsoft.Compute/virtualMachineScaleSets/read
  • Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read
  • Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read

  When coverage for CMK encrypted disks is enabled, these additional permissions are used:

  • Microsoft.KeyVault/vaults/keys/read
  • Microsoft.KeyVault/vaults/keys/wrap/action
  • Microsoft.KeyVault/vaults/keys/unwrap/action

• AWS permissions - The role “VmScanner” is assigned to the scanner when you enable agentless scanning. This role has the minimal permission set to create and clean up snapshots (scoped by tag) and to verify the current state of the VM. The detailed permissions are:

  Attribute	Value
  SID	VmScannerDeleteSnapshotAccess
  Actions	ec2:DeleteSnapshot
  Conditions	"StringEquals":{"ec2:ResourceTag/CreatedBy”: "Microsoft Defender for Cloud"}
  Resources	arn:aws:ec2:::snapshot/
  Effect	Allow

  Attribute	Value
  SID	VmScannerAccess
  Actions	ec2:ModifySnapshotAttribute ec2:DeleteTags ec2:CreateTags ec2:CreateSnapshots ec2:CopySnapshots ec2:CreateSnapshot
  Conditions	None
  Resources	arn:aws:ec2:::instance/ arn:aws:ec2:::snapshot/ arn:aws:ec2:::volume/
  Effect	Allow

  Attribute	Value
  SID	VmScannerVerificationAccess
  Actions	ec2:DescribeSnapshots ec2:DescribeInstanceStatus
  Conditions	None
  Resources	*
  Effect	Allow

  Attribute	Value
  SID	VmScannerEncryptionKeyCreation
  Actions	kms:CreateKey
  Conditions	None
  Resources	*
  Effect	Allow

  Attribute	Value
  SID	VmScannerEncryptionKeyManagement
  Actions	kms:TagResource kms:GetKeyRotationStatus kms:PutKeyPolicy kms:GetKeyPolicy kms:CreateAlias kms:ListResourceTags
  Conditions	None
  Resources	arn:aws:kms::${AWS::AccountId}:key/ arn:aws:kms:*:${AWS::AccountId}:alias/DefenderForCloudKey
  Effect	Allow

  Attribute	Value
  SID	VmScannerEncryptionKeyUsage
  Actions	kms:GenerateDataKeyWithoutPlaintext kms:DescribeKey kms:RetireGrant kms:CreateGrant kms:ReEncryptFrom
  Conditions	None
  Resources	arn:aws:kms::${AWS::AccountId}:key/
  Effect	Allow

• GCP permissions: during onboarding - a new custom role is created with minimal permissions required to get instances status and create snapshots. On top of that permissions to an existing GCP KMS role are granted to support scanning disks that are encrypted with CMEK. The roles are:

  • roles/MDCAgentlessScanningRole granted to Defender for Cloud’s service account with permissions: compute.disks.createSnapshot, compute.instances.get
  • roles/cloudkms.cryptoKeyEncrypterDecrypter granted to Defender for Cloud’s compute engine service agent

Send is the minimum SAS policy permissions required. For step-by-step instructions, see Step 1: Create an Event Hubs namespace and event hub with send permissions in this article.