Shared Dashboard Permissions - LA Queries Across Workspaces

%3CLINGO-SUB%20id%3D%22lingo-sub-1720771%22%20slang%3D%22en-US%22%3EShared%20Dashboard%20Permissions%20-%20LA%20Queries%20Across%20Workspaces%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1720771%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3EWe%20have%20numerous%20subscriptions%20(one%20per%20customer)%20in%20Azure.%20Each%20subscription%20has%20its%20own%20Log%20Analytics%20workspace.%20We%20have%20a%20governance%20subscription%20where%20I%20have%20created%20Log%20Analytics%20alerts%20(CPU%2C%20Memory%2C%20Disk)%20that%20query%20across%20all%20workspaces%20and%20I%20pin%20that%20query%20to%20a%20Dashboard.%20I%20give%20our%20Service%20Desk%20permissions%20to%20the%20Dashboard%20and%20they%20can%20see%20the%20Dashboard%20but%20they%20can't%20see%20the%20results%20of%20the%20queries.%20What%20are%20the%20least%20privileges%20I%20can%20give%20them%20so%20they%20can%20see%20the%20results%20of%20the%20queries%20in%20the%20Dashboard.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1724684%22%20slang%3D%22en-US%22%3ERe%3A%20Shared%20Dashboard%20Permissions%20-%20LA%20Queries%20Across%20Workspaces%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1724684%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F584820%22%20target%3D%22_blank%22%3E%40jwrossi%3C%2FA%3E%26nbsp%3BDid%20you%20try%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Frole-based-access-control%2Fbuilt-in-roles%23log-analytics-reader%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3ELog%20Analytics%20Reader%3C%2FA%3E%3F%20It%20kind%20of%20depends%20on%20where%20you%20assigned%20rights%2C%20and%20whether%20you%20have%20a%20single%20tenant%20or%20multiple.%20If%20you%20assign%20this%20right%20in%20the%20root%20management%20group%20to%20your%20service%20desk%20group%2C%20it%20trickles%20down%20to%20all%20subscriptions%20under%20the%20same%20tenant.%20If%20you%20have%20multiple%20tenants%2C%20then%20you%20need%20to%20look%20to%20Azure%20Lighthouse.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBTW%2C%20I'm%20curious%20on%20how%20you%20do%20the%20cross%20subscription%20query.%20I%20know%20about%20a%20query%20like%20below%20(getting%20AV%20protection%20status%20of%20machines%20that%20aren't%20healthy%20across%20two%20customers)%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-sql%22%3E%3CCODE%3Eunion%20ProtectionStatus%2C%0A%2F%2FcustomerA%0Aworkspace(%22workspaceid_custA%22).ProtectionStatus%2C%0A%2F%2FcustomerB%0Aworkspace(%22workspaceid_custB%22).ProtectionStatus%0A%7C%20where%20ProtectionStatusRank%20!%3D%20150%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1731833%22%20slang%3D%22en-US%22%3ERe%3A%20Shared%20Dashboard%20Permissions%20-%20LA%20Queries%20Across%20Workspaces%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1731833%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F671042%22%20target%3D%22_blank%22%3E%40-Akos-%3C%2FA%3E%26nbsp%3B%20Hi%2C%20Thanks%20for%20the%20input.%20I%20tried%20Log%20Analytics%20Reader%20but%20it%20gives%20the%20following%20permissions%3A%26nbsp%3BThe%20Log%20Analytics%20Reader%20role%20includes%20the%20following%20Azure%20actions%3A%20For%20workspaces%2C%20it%20allows%20full%20unrestricted%20permissions%20to%20read%20the%20workspace%20settings%20and%20%3CSTRONG%3Eperform%20query%20on%20the%20data%3C%2FSTRONG%3E.%26nbsp%3B%20I%20would%20like%20the%20Service%20Desk%20personnel%20to%20be%20able%20to%20see%20the%20data%20from%20the%20cross-workspace%20queries%20in%20the%20Dashboard%20but%20I%20don't%20want%20them%20to%20be%20able%20to%20perform%20queries.%3C%2FP%3E%3CP%3ERegarding%20the%20cross-workspace%20queries%2C%20I%20am%20doing%20what%20you%20show%20in%20your%20post.%20I%20create%20a%20function%20for%20the%20actual%20union%20so%20that%20I%20can%20reuse%20that%20function%20across%20multiple%20queries%20(CPU%2C%20Memory%2C%20Disk%2C%20etc.)%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1732231%22%20slang%3D%22en-US%22%3ERe%3A%20Shared%20Dashboard%20Permissions%20-%20LA%20Queries%20Across%20Workspaces%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1732231%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F584820%22%20target%3D%22_blank%22%3E%40jwrossi%3C%2FA%3E%26nbsp%3BBut%20isn't%20a%20dashboard%20just%20the%20graphical%20version%20of%20the%20query%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi,

We have numerous subscriptions (one per customer) in Azure. Each subscription has its own Log Analytics workspace. We have a governance subscription where I have created Log Analytics alerts (CPU, Memory, Disk) that query across all workspaces and I pin that query to a Dashboard. I give our Service Desk permissions to the Dashboard and they can see the Dashboard but they can't see the results of the queries. What are the least privileges I can give them so they can see the results of the queries in the Dashboard.

6 Replies

@jwrossi Did you try Log Analytics Reader? It kind of depends on where you assigned rights, and whether you have a single tenant or multiple. If you assign this right in the root management group to your service desk group, it trickles down to all subscriptions under the same tenant. If you have multiple tenants, then you need to look to Azure Lighthouse.

 

BTW, I'm curious on how you do the cross subscription query. I know about a query like below (getting AV protection status of machines that aren't healthy across two customers) 

 

union ProtectionStatus,
//customerA
workspace("workspaceid_custA").ProtectionStatus,
//customerB
workspace("workspaceid_custB").ProtectionStatus
| where ProtectionStatusRank != 150

 

@-Akos-  Hi, Thanks for the input. I tried Log Analytics Reader but it gives the following permissions: The Log Analytics Reader role includes the following Azure actions: For workspaces, it allows full unrestricted permissions to read the workspace settings and perform query on the data.  I would like the Service Desk personnel to be able to see the data from the cross-workspace queries in the Dashboard but I don't want them to be able to perform queries.

Regarding the cross-workspace queries, I am doing what you show in your post. I create a function for the actual union so that I can reuse that function across multiple queries (CPU, Memory, Disk, etc.)

@jwrossi But isn't a dashboard just the graphical version of the query?

@-Akos-  Yes, but I only want them to be able to see the results of specific queries that I choose (CPU, Memory, Disk). I don't want them to be able to create their own queries and query for any information they choose to. These are Service Desk personnel and I don't want them to have this capability.

@jwrossi Hmm, It doesn't seem like that would be possible, but you could create an RBAC role that would only limit access to certain tables, (see here), alternatively you could push the data to PowerBI, and create a report there, and then you can keep the service desk away from Log Analytics altogether.