Permissions

The recommended approach is to assign the Reader role to the Service Principal on every subscription that should be monitored. At a minimum, a custom role must allow the application to list accessible subscriptions and read Service Health events, including Microsoft.ResourceHealth/events/read.

Sensitive details from some security advisories may be hidden from identities without elevated permissions. The plugin queries the event list but does not call the additional fetchEventDetails operation required to retrieve sensitive content.