# Restrict cloud query permissions to access only specific Azure assets

**URL:** <https://community.cloudquery.io/t/restrict-cloud-query-permissions-to-access-only-specific-azure-assets/282>\
**Category:** CloudQuery Plugins\
**Created:** [March 21, 2024, 3:55am UTC](https://community.cloudquery.io/t/restrict-cloud-query-permissions-to-access-only-specific-azure-assets/282 "2024-03-21T03:55:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![decent-warthog](https://avatars.discourse-cdn.com/v4/letter/d/6de8d8/32.png) [@decent-warthog](https://community.cloudquery.io/u/decent-warthog)\
**Post date:** [March 21, 2024, 3:55am UTC](https://community.cloudquery.io/t/restrict-cloud-query-permissions-to-access-only-specific-azure-assets/282/1 "2024-03-21T03:55:22Z")

</div>

Hello,

How do we restrict the CloudQuery permission only to get relevant information, but not information like the following? My infosec team is particular about giving access to the Azure subscription, and they want us to discover only assets/infrastructure/services and nothing else. Can anyone help me achieve this?

- Security policies
- Data exports
- Network peerings
- Operational recommendations
- Billing data
- Network rule sets
- Managed keys
- User keys/secrets
- Configurations
- Route tables
- Log activity alerts

---

<div class="post-metadata">

**Author:** ![herman](https://sea1.discourse-cdn.com/flex001/user_avatar/community.cloudquery.io/herman/32/27_2.png) [@herman](https://community.cloudquery.io/u/herman)\
**Post date:** [March 21, 2024, 9:02am UTC](https://community.cloudquery.io/t/restrict-cloud-query-permissions-to-access-only-specific-azure-assets/282/2 "2024-03-21T09:02:33Z")

</div>

Hi @decent-warthog 👋

If I’m understanding your question correctly, you’ll have to restrict the access that the service principal has, giving it access only to the resources you’ve selected for CloudQuery to sync (the tables you’ve selected).

To start off, we recommend using the Reader role, as that gives all the access CloudQuery might need. It tends to be wider than necessary though, so you can have a look at other built-in roles here: [Built-in Roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles) and either select from there or build a custom role with read access to only the resources you want to sync.

I don’t have more specific advice, like the exact permissions you need, as that will depend largely on the tables you choose to sync, and it goes a bit beyond what we can do in terms of community support. We do have [support plans](https://www.cloudquery.io/pricing), should you be interested.

---

<div class="post-metadata">

**Author:** ![decent-warthog](https://avatars.discourse-cdn.com/v4/letter/d/6de8d8/32.png) [@decent-warthog](https://community.cloudquery.io/u/decent-warthog)\
**Post date:** [March 22, 2024, 6:11am UTC](https://community.cloudquery.io/t/restrict-cloud-query-permissions-to-access-only-specific-azure-assets/282/3 "2024-03-22T06:11:14Z")

</div>

Thanks. But I was looking if the support is to restrict for one resource as advice?

For example, with the Firewall resource, we only need firewall subscription level information, but we should not be getting the rules related information.

---

<div class="post-metadata">

**Author:** ![herman](https://sea1.discourse-cdn.com/flex001/user_avatar/community.cloudquery.io/herman/32/27_2.png) [@herman](https://community.cloudquery.io/u/herman)\
**Post date:** [March 22, 2024, 8:54am UTC](https://community.cloudquery.io/t/restrict-cloud-query-permissions-to-access-only-specific-azure-assets/282/4 "2024-03-22T08:54:17Z")

</div>

Oh, I see. Yes, you can sync only the tables you are interested in.

For example, to get firewall subscription level information, you can set:

```yaml
tables: ["azure_network_azure_firewalls"]

```

This won’t sync the rules.

Sometimes a table has other tables that depend on it. For example, if you sync `azure_sql_servers`, it will also sync `azure_sql_server_firewall_rules` by default. But you can turn off this behavior by setting:

```yaml
skip_dependent_tables: true

```

(More on this: [Improve Performance by Skipping Relations](https://docs.cloudquery.io/docs/advanced-topics/performance-tuning#improve-performance-by-skipping-relations)).

Or you can use:

```yaml
skip_tables: ["azure_sql_server_firewall_rules"]

```

---

<div class="post-metadata">

**Author:** ![decent-warthog](https://avatars.discourse-cdn.com/v4/letter/d/6de8d8/32.png) [@decent-warthog](https://community.cloudquery.io/u/decent-warthog)\
**Post date:** [March 23, 2024, 10:14am UTC](https://community.cloudquery.io/t/restrict-cloud-query-permissions-to-access-only-specific-azure-assets/282/5 "2024-03-23T10:14:58Z")

</div>

ok thanks for this insight…we will try from here, if we need anything then i will go with your paid support mode.