Service Principal issues on Panorama Plugin for Azure

[cezarb]

While setting up the Service Principal on Panorama Plugin for Azure, even though the IAM role of reader seems to be properly defined in Azure we get this error message during the validation phase:

ERROR: Validation of #######-####-####-############ failed with msg Failed to validate credentials with error - Failed to validated Azure Monitoring permissions and Deployment permissions. Error: Failed to validate monitoring permissions. Error: Missing permission for 'Microsoft.Compute/virtualMachines/read', please update service principal.

Any ideea what else might cause this? Most probably is something very simple we are missing but we run out of troubleshooting leads now and any suggestion will be highly appreciated.

[MichaelBredell]

Having the same issue, did you ever resolve this?

[Blake_Wofford]

Yes, I'm having this issue as well and have a TAC case open, but so far no luck - please post if you find a solution!

[dmaynard]

PLUG-7780 - When the monitoring definition service principle for VM monitoring in Azure is configured correctly on the Panorama plugin for Azure 3.0.x with PAN-OS 10.0.x, the service principal validation check displays as failed under 

Panorama > Azure > Setup > Service Principal

.

Please find the list of actions/permissions required to support monitoring for the Azure 3.0.1 plugin below:

The list of permissions required to enable monitoring are as below:

"actions": [
"Microsoft.Compute/virtualMachines/read",
"Microsoft.Network/networkInterfaces/read",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/locations/serviceTags/read",
"Microsoft.Network/loadBalancers/read",
"Microsoft.Resources/subscriptions/resourcegroups/read",
"Microsoft.Network/publicIPAddresses/read"
]

With these permissions assigned to a service principal, validation will fail but the monitoring functionality is not affected and the 3.0.1 plugin will continue to function as designed.

[CStorrar]

Panorama 
OS version 10.1.x  
Azure plugin 3.1

I can the below error, when trying to validate Service Principle 

Failed to validate credentials with error - Failed to validated Azure Monitoring permissions and Deployment permissions. Error: Failed to validate monitoring permissions. Error: Missing permission for 'Microsoft.Compute/virtualMachines/read', please update service principal.

Azure App is set with "reader" 

Can anyone explain more what to check or what the problem could be ?

[agagliardi]

Good afternoon, I have the same issue and I read that the application should have the "Reader" role. Is this correct? Could you please guide me on how to grant those permissions from the Azure portal?