topic Re: Service Principal issues on Panorama Plugin for Azure in Integration Discussions

Service Principal issues on Panorama Plugin for Azure

cezarb — Fri, 30 Apr 2021 16:34:56 GMT

While setting up the Service Principal on Panorama Plugin for Azure, even though the IAM role of reader seems to be properly defined in Azure we get this error message during the validation phase:

ERROR: Validation of #######-####-####-############ failed with msg Failed to validate credentials with error - Failed to validated Azure Monitoring permissions and Deployment permissions. Error: Failed to validate monitoring permissions. Error: Missing permission for 'Microsoft.Compute/virtualMachines/read', please update service principal.

Any ideea what else might cause this? Most probably is something very simple we are missing but we run out of troubleshooting leads now and any suggestion will be highly appreciated.

Re: Service Principal issues on Panorama Plugin for Azure

MichaelBredell — Mon, 28 Mar 2022 10:42:15 GMT

Having the same issue, did you ever resolve this?

Re: Service Principal issues on Panorama Plugin for Azure

Blake_Wofford — Tue, 29 Mar 2022 14:19:04 GMT

Yes, I'm having this issue as well and have a TAC case open, but so far no luck - please post if you find a solution!

Re: Service Principal issues on Panorama Plugin for Azure

dmaynard — Wed, 13 Apr 2022 10:21:01 GMT

PLUG-7780 - When the monitoring definition service principle for VM monitoring in Azure is configured correctly on the Panorama plugin for Azure 3.0.x with PAN-OS 10.0.x, the service principal validation check displays as failed under

Panorama > Azure > Setup > Service Principal

Please find the list of actions/permissions required to support monitoring for the Azure 3.0.1 plugin below:

The list of permissions required to enable monitoring are as below:

"actions": [
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Network/networkInterfaces/read",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/locations/serviceTags/read",
"Microsoft.Network/loadBalancers/read",
"Microsoft.Resources/subscriptions/resourcegroups/read",
"Microsoft.Network/publicIPAddresses/read"
]

With these permissions assigned to a service principal, validation will fail but the monitoring functionality is not affected and the 3.0.1 plugin will continue to function as designed.

Re: Service Principal issues on Panorama Plugin for Azure

CStorrar — Thu, 30 Mar 2023 17:42:02 GMT

Panorama
OS version 10.1.x
Azure plugin 3.1

I can the below error, when trying to validate Service Principle

Failed to validate credentials with error - Failed to validated Azure Monitoring permissions and Deployment permissions. Error: Failed to validate monitoring permissions. Error: Missing permission for 'Microsoft.Compute/virtualMachines/read', please update service principal.

Azure App is set with "reader"

Can anyone explain more what to check or what the problem could be ?

Re: Service Principal issues on Panorama Plugin for Azure

agagliardi — Wed, 11 Dec 2024 19:32:43 GMT

Good afternoon, I have the same issue and I read that the application should have the "Reader" role. Is this correct? Could you please guide me on how to grant those permissions from the Azure portal?