Requirements

The recommended configuration is to use a Service Principal with read-only permissions. 
 The plugin needs permission to: 
 
 List Microsoft.Sql/servers resources. 
 List Microsoft.Sql/servers/databases resources. 
 Read basic database properties such as status, edition, SKU, and maximum size. 
 Query Azure Monitor metrics for each database. 
 
 In most environments, the Reader role on the subscription or on the target resource group is enough. When access is limited to a single resource group, the Resource group field should also be configured in the Discovery task.