Azure Required Permissions

The following permissions are required to connect Microsoft Entra ID and Azure subscriptions/organizations to Tenable One AI Exposure. For step-by-step guidance on resolving Azure permission and role errors, see Resolve Cloud Onboarding Permission and Role Errors (AWS, Azure, GCP).

Microsoft Entra ID Permissions

Deploying the required configuration for the AI Exposure Connector application in Microsoft Entra ID grants Tenable the following permissions:

  • Read all access reviews (AccessReview.Read.All). Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user.
  • Read all audit log data (AuditLog.Read.All). Allows the app to read and query your audit log activities, without a signed-in user.
  • Read directory data (Directory.Read.All). Allows the app to read data in your organization's directory, such as users, groups and apps, without a signed-in user.
  • Read your organization's policies (Policy.Read.All). Allows the app to read all your organization's policies without a signed in user.
  • Read assignment schedules for access to Azure AD groups (PrivilegedAssignmentSchedule.Read.AzureADGroup). Allows the app to read time-based assignment schedules for access to Microsoft Entra ID groups, without a signed-in user.
  • Read eligibility schedules for access to Azure AD groups (PrivilegedEligibilitySchedule.Read.AzureADGroup). Allows the app to read time-based eligibility schedules for access to Microsoft Entra ID groups, without a signed-in user.
  • View users' basic profile (profile). Allows the app to see your users' basic profile (e.g., name, picture, user name, email address).
  • Read role management data for all RBAC providers (RoleManagement.Read.All). Allows the app to read role-based access control (RBAC) settings for all RBAC providers without a signed-in user. This includes reading role definitions and role assignments.
  • Read all policies in PIM for Groups (RoleManagementPolicy.Read.AzureADGroup). Allows the app to read policies in Privileged Identity Management for Groups, without a signed-in user.

These permissions are needed for Tenable to gather and report data related to relevant Microsoft Entra ID resources.

Important: Running the deployment script creates or updates a service principal in your tenant. The service principal represents the AI Exposure Connector application within your directory and enables it to access the required Microsoft Entra ID and Azure resources, based on the permissions and roles you assign.

For more information about application and service principal objects in Microsoft Entra ID, refer to Microsoft documentation.

Update Permissions for Tenable App

You may need to update permissions for the AI Exposure Connector app due to changes made by Microsoft, or to support new services introduced by Tenable. Since AI Exposure operates agentlessly with read-only access, these permissions cannot be updated automatically. Any updates must be made manually within your Azure account, by updating permissions.

  1. Log in to the Azure portal for the relevant tenant.
  2. Navigate to Microsoft Entra ID
  3. Under Manage, click Enterprise applications
  4. Search for and select the AI Exposure Connector app.
  5. Navigate to Security > Permissions.
  6. Click Grant admin consent for...
  7. On the Microsoft account sign in page, pick an admin account belonging to the tenant Tenable.

Azure Permissions

This table lists the permissions (Azure roles) required to connect Azure to AI Exposure for each of the following AI Exposure capabilities.

Capability Description Azure Role Notes
Monitoring (read-only) Gain visibility into cloud assets, including subscription usage and security configurations.
  • Reader
  • Key Vault Reader
  • Azure Kubernetes Service Cluster User Role
  • Azure Kubernetes Service RBAC Reader
  • Cognitive Services Data Reader
  • The Key Vault Reader role only allows read access to metadata of key vaults and its certificates, keys, and secrets. It doesn’t grant access to read sensitive values such as secret contents or key material. For more information, refer to the relevant Microsoft documentation.
  • The two Kubernetes roles provide visibility and risk assessment for cloud identities and resources associated with AKS clusters. For more information about connecting AKS clusters and requirements, including 1) additional permissions required for full IAM visibility, and 2) network access requirements, see Connect an Azure AKS Cluster.
  • Tenable uses the Cognitive Services Data Reader to list AI Foundry resources by reading metadata only.
Data Resources Scanning (Data Protection) Scan and classify cloud resources for sensitive data. See Data Protection for more information.
  • Storage Blob Data Reader built-in role
  • Tenable Data Scanning custom role, with the following permissions:
    • Microsoft.Storage/storageAccounts/privateEndpointConnections/write
    • Microsoft.Sql/servers/databases/write
 See Data Protection documentation for more information.
Workload Protection Scan virtual machines for vulnerabilities and misconfigurations.
  • Disk Snapshot Contributor built-in role

As an alternative to the built-in role, you can grant a custom role with the following permissions instead:

  • Microsoft.Compute/snapshots/beginGetAccess/action
  • Microsoft.Compute/disks/beginGetAccess/action
  • Microsoft.Compute/snapshots/write
  • Microsoft.Compute/snapshots/endGetAccess/action
  • Microsoft.Compute/snapshots/delete

To scan Windows virtual machines with BitLocker or Linux virtual machines with DM-Crypt (Ubuntu only) disk encryption, also grant:

  • Key Vault Secrets User built-in role, or the Microsoft.KeyVault/vaults/secrets/getSecret/action custom permission

To scan a BitLocker encryption secret using a key from the key vault (KEK), also grant:

  • Key Vault Crypto User built-in role, or the Microsoft.KeyVault/vaults/keys/unwrap/action custom permission
 Using this feature requires the Standard/Enterprise license. Key Vault permissions can be granted per subscription or per key vault. See Connect Workloads for the procedure to grant these permissions.
Remediation (read-write) Allow Tenable to make changes in your environment. This lets you automatically remediate findings with one click, for example (One-click remediation is still available via OTP without these permissions). Owner
Just-in-time Access Grant users access to cloud accounts for a predetermined period of time and on an as-needed basis. To use this capability, you must also onboard your Microsoft Entra ID integration. User Access Administrator
IaC - Trace Issues Back to Code Storage Blob Data Reader This permission can only be enabled by editing the account, after connecting it successfully.

Important: Running the deployment script creates or updates a service principal in your tenant. The service principal represents the AI Exposure Connector application within your directory and enables it to access the required Microsoft Entra ID and Azure resources, based on the permissions and roles you assign.

For more information about application and service principal objects in Microsoft Entra ID, refer to Microsoft documentation.