# Requirements

The recommended configuration is to use a Service Principal with read-only permissions.

The plugin needs permission to:

- List `Microsoft.Sql/servers` resources.
- List `Microsoft.Sql/servers/databases` resources.
- Read basic database properties such as status, edition, SKU, and maximum size.
- Query Azure Monitor metrics for each database.

In most environments, the `Reader` role on the subscription or on the target resource group is enough. When access is limited to a single resource group, the **Resource group** field should also be configured in the Discovery task.