> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/resilience-testing/chaos-engineering/faults/chaos-fault-categories/azure/security-configurations/fault-permissions.md).

# Required Permissions and Custom Roles For Azure Chaos Faults

A reference guide for the minimum Azure role permissions required by each chaos faults and a superset role covering all.

***

### Superset Role for All Azure Faults <a href="#superset-role-for-all-azure-faults" id="superset-role-for-all-azure-faults"></a>

#### Required Azure RBAC Permissions <a href="#required-azure-rbac-permissions" id="required-azure-rbac-permissions"></a>

This superset combines all permissions required for Disk Loss, Instance Stop, Web App operations, and Azure Stress faults.

```json
{
  "Name": "Harness Chaos Engineering - Azure Superset Role",
  "IsCustom": true,
  "Description": "Superset role combining all Azure permissions required for supported chaos faults.",
  "Actions": [
    "Microsoft.Compute/disks/read",
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/write",
    "Microsoft.Compute/virtualMachineScaleSets/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write",
    "Microsoft.Compute/virtualMachines/powerOff/action",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/instanceView/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/powerOff/action",
    "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/start/action",
    "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read",
    "Microsoft.Web/sites/read",
    "Microsoft.Web/sites/config/list/action",
    "Microsoft.Web/sites/config/write",
    "Microsoft.Web/sites/state/action",
    "Microsoft.Web/sites/stop/action",
    "Microsoft.Web/sites/start/action",
    "Microsoft.Compute/virtualMachines/runCommand/action",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action",
    "Microsoft.Resources/subscriptions/resourceGroups/read"
  ],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/<your-subscription-id>"
  ]
}
```

***

### Disk Loss <a href="#disk-loss" id="disk-loss"></a>

#### Required Azure RBAC Permissions <a href="#required-azure-rbac-permissions" id="required-azure-rbac-permissions"></a>

| Azure RBAC Permission                                           | Action Description                                              |
| --------------------------------------------------------------- | --------------------------------------------------------------- |
| Microsoft.Compute/disks/read                                    | <p>Read managed disk metadata<br>Get disk attachment status</p> |
| Microsoft.Compute/virtualMachines/read                          | Read VM/VMSS instance properties                                |
| Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read  | Read VM/VMSS instance properties                                |
| Microsoft.Compute/virtualMachines/write                         | Modify VM data disk attachments                                 |
| Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write | Modify VMSS VM data disk attachments                            |

#### Sample Custom Role <a href="#sample-custom-role" id="sample-custom-role"></a>

```json
{
  "Name": "Harness Chaos Engineering - Azure Disk Loss",
  "IsCustom": true,
  "Description": "Allows detaching and reattaching managed disks to VM/VMSS instances.",
  "Actions": [
    "Microsoft.Compute/disks/read",
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/write",
    "Microsoft.Compute/virtualMachineScaleSets/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write"
  ],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/<your-subscription-id>"
  ]
}
```

***

### Instance Stop <a href="#instance-stop" id="instance-stop"></a>

#### Required Azure RBAC Permissions <a href="#required-azure-rbac-permissions" id="required-azure-rbac-permissions"></a>

| Azure RBAC Permission                                                       | Action Description          |
| --------------------------------------------------------------------------- | --------------------------- |
| Microsoft.Compute/virtualMachines/read                                      | Read VM metadata            |
| Microsoft.Compute/virtualMachines/powerOff/action                           | Power off standalone VM     |
| Microsoft.Compute/virtualMachines/start/action                              | Start standalone VM         |
| Microsoft.Compute/virtualMachines/instanceView/read                         | Get instance status         |
| Microsoft.Compute/virtualMachineScaleSets/virtualmachines/read              | Read VMSS instance metadata |
| Microsoft.Compute/virtualMachineScaleSets/virtualmachines/powerOff/action   | Power off VMSS instance     |
| Microsoft.Compute/virtualMachineScaleSets/virtualmachines/start/action      | Start VMSS instance         |
| Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read | Get VMSS instance status    |

#### Sample Custom Role <a href="#sample-custom-role" id="sample-custom-role"></a>

```json
{
  "Name": "Harness Chaos Engineering - Azure Instance Stop",
  "IsCustom": true,
  "Description": "Allows stopping and starting VMs and scale set VMs.",
  "Actions": [
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/powerOff/action",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/instanceView/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/powerOff/action",
    "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/start/action",
    "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read"
  ],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/<your-subscription-id>"
  ]
}
```

***

### Web App Access Restriction <a href="#web-app-access-restriction" id="web-app-access-restriction"></a>

#### Required Azure RBAC Permissions <a href="#required-azure-rbac-permissions" id="required-azure-rbac-permissions"></a>

| Azure RBAC Permission                  | Action Description    |
| -------------------------------------- | --------------------- |
| Microsoft.Web/sites/read               | List all Web Apps     |
| Microsoft.Web/sites/config/list/action | Get Web App Config    |
| Microsoft.Web/sites/config/write       | Update Web App Config |
| Microsoft.Web/sites/state/action       | Get Web App Status    |

#### Sample Custom Role <a href="#sample-custom-role" id="sample-custom-role"></a>

```json
{
  "Name": "Harness Chaos Engineering - Web App Access Restriction",
  "IsCustom": true,
  "Description": "Allows reading and modifying Web App access restriction rules.",
  "Actions": [
    "Microsoft.Web/sites/read",
    "Microsoft.Web/sites/config/list/action",
    "Microsoft.Web/sites/config/write",
    "Microsoft.Web/sites/state/action"
  ],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/<your-subscription-id>"
  ]
}
```

***

### Web App Stop <a href="#web-app-stop" id="web-app-stop"></a>

#### Required Azure RBAC Permissions <a href="#required-azure-rbac-permissions" id="required-azure-rbac-permissions"></a>

| Azure RBAC Permission            | Action Description |
| -------------------------------- | ------------------ |
| Microsoft.Web/sites/read         | Read app metadata  |
| Microsoft.Web/sites/stop/action  | Stop the app       |
| Microsoft.Web/sites/start/action | Start the app      |
| Microsoft.Web/sites/state/action | Get app state      |

#### Sample Custom Role <a href="#sample-custom-role" id="sample-custom-role"></a>

```json
{
  "Name": "Harness Chaos Engineering - Web App Stop",
  "IsCustom": true,
  "Description": "Allows stopping and starting Azure Web Apps.",
  "Actions": [
    "Microsoft.Web/sites/read",
    "Microsoft.Web/sites/stop/action",
    "Microsoft.Web/sites/start/action",
    "Microsoft.Web/sites/state/action"
  ],
  "NotActions": [],
  "DataActions": [],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/<your-subscription-id>"
  ]
}
```

***

### Azure Stress (CPU & Memory) <a href="#azure-stress-cpu-and-memory" id="azure-stress-cpu-and-memory"></a>

#### Required Azure RBAC Permissions <a href="#required-azure-rbac-permissions" id="required-azure-rbac-permissions"></a>

| Azure RBAC Permission                                                       | Action Description                       |
| --------------------------------------------------------------------------- | ---------------------------------------- |
| Microsoft.Compute/virtualMachines/runCommand/action                         | Execute scripts on VMs using Run Command |
| Microsoft.Compute/virtualMachines/read                                      | Read VM instance details                 |
| Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read | Read the status of VMSS instances        |
| Microsoft.Resources/subscriptions/resourceGroups/read                       | Read resource group metadata             |

#### Sample Custom Role <a href="#sample-custom-role" id="sample-custom-role"></a>

```json
{
  "Name": "Harness Chaos Engineering - Azure Stress",
  "IsCustom": true,
  "Description": "Minimal custom role for executing stress chaos fault on Azure VMs and VMSS",
  "Actions": [
    "Microsoft.Compute/virtualMachines/runCommand/action",
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.Compute/virtualMachines/powerOff/action",
    "Microsoft.Compute/virtualMachines/start/action",
    "Microsoft.Compute/virtualMachines/instanceView/read",
    "Microsoft.Compute/virtualMachineScaleSets/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/instanceView/read",
    "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/runCommand/action",
    "Microsoft.Resources/subscriptions/resourceGroups/read"
  ],
  "NotActions": [],
  "AssignableScopes": [
    "/subscriptions/<your-subscription-id>"
  ]
}
```

***

**Note:** Replace `<your-subscription-id>` with your actual Azure subscription ID.