1.0 Fortanix Key Insight - Azure Permissions Using Custom Roles
This section describes the read permissions required to onboard an Azure connection using custom roles in Fortanix Key Insight. It provides a detailed list of Role-Based Access Control (RBAC) permissions that must be granted to enable secure and successful integration with Azure resources.
1.1 Azure Permissions (Services) - Actions
This section describes the Azure Actions permissions required to integrate Azure services with Fortanix Key Insight.
Azure Service | Permission | Description |
|---|---|---|
Azure Resource Manager (ARM) |
| Read access to subscription metadata. |
| Read access to resource groups within a subscription. | |
Azure Key Vault |
| Read metadata about Key Vault instances. |
| Read all versions of a key in Key Vault. | |
| Read information about soft-deleted Key Vaults. | |
Azure Storage |
| Read metadata about Azure storage accounts. |
| Read metadata about blob containers. | |
| Read encryption scope configurations within storage accounts. | |
Azure SQL |
| Read SQL Server metadata and configurations. |
| Read encryption protector settings for SQL servers. | |
| Read metadata about SQL databases. | |
| Read Transparent Data Encryption (TDE) settings for SQL databases. | |
| Read the configuration details of SQL managed instances. | |
| Read encryption protector settings for SQL managed instances. | |
| Read metadata about databases within SQL managed instances. | |
Azure Compute (Managed Disks) |
| Read metadata about managed disks. |
| Read the configuration of disk encryption sets. | |
Azure IAM (RBAC) |
| Read role definitions in RBAC (used for defining custom roles). |
| Read role assignments at various scopes. | |
Azure Container Instances |
| Read metadata about Azure Container Instance groups. |
Azure Kubernetes Service (AKS) |
| Read information about managed Kubernetes clusters. |
Azure Cosmos DB |
| Read metadata about Cosmos DB accounts. |
| Read MongoDB cluster configurations hosted in Cosmos DB. |
1.2 Azure Permissions (Services) - Data Actions
This section describes the Azure Data Actions permissions required to integrate Azure services with Fortanix Key Insight.
Azure Service | Permission | Description |
|---|---|---|
Azure Key Vault |
| Read Key Vault keys and their properties. |
| Read key rotation policies set on Key Vault keys. | |
Azure Storage |
| Read data and properties of individual blobs in containers. |
NOTE
You can grant permissions to Azure Key Vault using one of the following methods:
RBAC: Refer to the Azure Key Vault permissions outlined in Section 1.1: Azure Permissions (Services) – Actions and Section 1.2: Azure Permissions (Services) – Data Actions.
Access Policy: If your Azure Key Vault is managed using Access Policies, you must have the following key permissions to scan your Azure Key Vault keys during onboarding to Fortanix Key Insight:
Key Operations
Permission
Description
Key Management Operations
getRetrieves the function of the Key Vault key.
listRetrieves the list of Key Vault keys.
Key Rotation Policy Operations
getrotationpolicyRetrieves the rotation policy of a particular Key Vault key.
1.3 Azure Permissions (Others)
This section describes the additional Azure-level permissions required to support broader management tasks, including role assignments, IAM visibility, and resource scope operations.
Azure Category | Permission | Description |
|---|---|---|
Azure IAM (RBAC) |
| Read role definitions in RBAC (used for defining custom roles). |
| Read role assignments at various scopes. | |
Azure Management Groups |
| Read metadata about Azure management groups. |
2.0 Fortanix Key Insight - Azure Permissions Using Built-In Roles
This section lists the permissions required to onboard an Azure connection using built-in roles in Fortanix Key Insight.
You must provide access to the following built-in roles in your Azure service principal at the management group and subscription levels to help users scan the required Azure keys and services on Fortanix Key Insight:
Reader
Key Vault Reader
Storage Blob Data Reader
For more information on how to provide access to the following built-in roles and in your Azure service principal, refer to the Fortanix Key Insight - Azure Configuration for Scanning Using Built-In Roles.
NOTE
After access is granted to the built-in roles at either the management group or subscription level, all necessary permissions required for Fortanix Key Insight to scan Azure keys and services will be automatically provisioned.