See all the things

Question

Is there a role in Azure that allows me to see EVERYTHING from the root of our Azure environment all the way down to the individual resources (i.e VMs, WAFs, WAF Logs, every single setting on networks, etc) for every subscription that has been created and will be created in the future without having to be added to it. I need the role to have only read access with no change access.

Answer 1

There isn't really a role like this. Azure roles control permissions to manage Azure resources, while Azure AD roles control permissions to manage Azure Active Directory resources. By default, these do not typically overlap. If all of the subscriptions are in the same Management Group, you can assign an Azure Management Group Owner role to someone and they should be able to access multiple subscriptions, but to manage the resources in the tenant you would need something like a Global Admin role at the tenant scope.

https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

https://learn.microsoft.com/en-us/azure/governance/management-groups/overview