Requirements

The recommended configuration is to use a Service Principal with read-only permissions.

The plugin needs permission to:

• List Microsoft.Sql/servers resources.
• List Microsoft.Sql/servers/databases resources.
• Read basic database properties such as status, edition, SKU, and maximum size.
• Query Azure Monitor metrics for each database.

In most environments, the Reader role on the subscription or on the target resource group is enough. When access is limited to a single resource group, the Resource group field should also be configured in the Discovery task.