user_impersonation on the ARM resource (https://management.azure.com/user_impersonation). Subscription, resource group, and resource access are Azure RBAC assignments, not extra OAuth scopes. Sites.Selected does not apply.
Minimal scopes per action
Each Azure Resource Manager connection also requests
openid and offline_access. These connection scopes apply in addition to the action scopes in the table.| Action | Description | Minimum scopes |
|---|---|---|
| Get resource | Gets one Azure control-plane resource by ARM ID. | https://management.azure.com/user_impersonation |
| List activity logs | Lists Azure Activity Log management events for a subscription. | https://management.azure.com/user_impersonation |
| List resource changes | Lists Azure Resource Graph change-history rows. | https://management.azure.com/user_impersonation |
| List resource groups | Lists Azure resource groups the signed-in user can see. | https://management.azure.com/user_impersonation |
| List subscriptions | Lists Azure subscriptions the signed-in user can access. | https://management.azure.com/user_impersonation |
| Query resources | Runs a Kusto query against Azure Resource Graph. | https://management.azure.com/user_impersonation |
| Resolve resource | Resolves an Azure resource by ARM ID or name. | https://management.azure.com/user_impersonation |
| Resolve subscription | Resolves an Azure subscription by ID or display name. | https://management.azure.com/user_impersonation |
| Search resources | Searches Azure Resource Graph for control-plane inventory. | https://management.azure.com/user_impersonation |