Azure Resource Manager - Docs

Review the minimum standard delegated scope mapping for every Azure Resource Manager action.

Azure Resource Manager uses user_impersonation on the ARM resource (https://management.azure.com/user_impersonation), not Microsoft Graph permissions. Subscription, resource group, and resource access are Azure RBAC assignments, not extra OAuth scopes. Sites.Selected does not apply.

Minimal scopes per action

Each Azure Resource Manager connection also requests openid and offline_access. These connection scopes apply in addition to the action scopes in the table.

Action	Description	Minimum scopes
Get resource	Gets one Azure control-plane resource by ARM ID.	`https://management.azure.com/user_impersonation`
List activity logs	Lists Azure Activity Log management events for a subscription.	`https://management.azure.com/user_impersonation`
List resource changes	Lists Azure Resource Graph change-history rows.	`https://management.azure.com/user_impersonation`
List resource groups	Lists Azure resource groups the signed-in user can see.	`https://management.azure.com/user_impersonation`
List subscriptions	Lists Azure subscriptions the signed-in user can access.	`https://management.azure.com/user_impersonation`
Query resources	Runs a Kusto query against Azure Resource Graph.	`https://management.azure.com/user_impersonation`
Resolve resource	Resolves an Azure resource by ARM ID or name.	`https://management.azure.com/user_impersonation`
Resolve subscription	Resolves an Azure subscription by ID or display name.	`https://management.azure.com/user_impersonation`
Search resources	Searches Azure Resource Graph for control-plane inventory.	`https://management.azure.com/user_impersonation`