AuthorizationFailed creating Microsoft.Insights/monitoredObjects despite Owner + tenant-root permissions

Hello Admin-AdviceLab, Thank you for providing the detailed troubleshooting information and the permissions validation performed so far.

Based on our review, there is currently no publicly documented tenant-level feature flag, preview enrollment process, or regional allow-list requirement specific to the creation of Microsoft.Insights/monitoredObjects resources for the Azure Monitor Agent Windows client installer scenario. The documented implementation relies on creating a tenant-level Monitored Object resource and associating Data Collection Rules (DCRs) to it.

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client?tabs=cli%2Ccli-1

One area that requires further validation is the RBAC assignment at the tenant root scope (/). While the permissions shared include Owner at the subscription level, Contributor at the Management Group level, User Access Administrator at the tenant root scope, and Monitoring Contributor at the tenant root scope, the Monitored Object resource is created at the tenant/provider level (/providers/Microsoft.Insights/monitoredObjects/{tenantId}), and creation may require Owner permissions at the tenant root scope (/) rather than at the subscription or management group scope.

Could you please verify whether the account performing the operation has an Owner role assignment directly at the tenant root scope (/)? You can validate this using Azure PowerShell or Azure CLI and confirm whether the assignment is present.

Additionally, please confirm the following:

• The tenant ID used in the Monitored Object resource path matches the tenant associated with the authenticated session.
• The specified Monitored Object location aligns with the region used for the Data Collection Rule.
• Whether a GET request against the Monitored Object endpoint succeeds or returns the same authorization error.

If Owner access is already assigned at the tenant root scope and the issue persists, the next step would be to engage the Azure Monitor engineering team for further investigation, as this may indicate a backend authorization or service-side issue rather than an RBAC configuration issue.

Once we receive the above validation results, we will be able to advise on the next steps accordingly. Thank you.

Dear @Admin -AdviceLab

The AuthorizationFailed on Microsoft.Insights/monitoredObjects/write for a tenant‑level monitored object is almost always a permissions/scope issue, not a regional or feature‑flag restriction. The monitored object is a tenant‑level ARM resource, so normal subscription Owner/Monitoring Contributor roles are not sufficient by themselves.

Key points:

• A monitored object must be created at scope /providers/Microsoft.Insights/monitoredObjects/{tenantId}.

Microsoft’s docs state: “Because a monitored object is a tenant-level resource, the scope of permissions is greater than the scope of the permissions required for a subscription. An Azure tenant admin might be required to perform this step.”learn.microsoft

• The recommended pattern is:
  1. Elevate a Microsoft Entra tenant admin to “Azure tenant admin” (Owner at root /).
  2. Assign the built‑in Monitored Object Contributor role (or equivalent custom role with Microsoft.Insights/monitoredObjects/write) at tenant root scope to the user/app that runs the PUT.

You can checkout by trying:

1. Use a Global Administrator account and enable “Elevate access” in Entra ID so that account has Owner at /. Then retry the PUT from that same identity.
2. Ensure the identity has Monitored Object Contributor (or a custom role including Microsoft.Insights/monitoredObjects/write) at tenant root (/), not just at subscription or management group.
3. Confirm you’re calling the API with the same tenant as the {tenantId} in the URL and that your token’s tid matches. A mismatch will cause AuthorizationFailed even with strong roles.
4. Wait a few minutes after new role assignments and refresh tokens (new Cloud Shell / az login) before retrying.

There is no documented regional restriction or preview enrollment flag specifically for monitoredObjects; the blocking factor in published cases is always tenant‑level RBAC.

References:

Set up the Azure Monitor Agent on Windows client devices (monitored object steps): https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-windows-client[learn.microsoft](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client)

Azure permissions for Monitor (includes Microsoft.Insights/MonitoredObjects/Write): https://docs.azure.cn/en-us/role-based-access-control/permissions/monitor[docs.azure](https://docs.azure.cn/en-us/role-based-access-control/permissions/monitor)

• Community confirmation that tenant‑admin / elevated access is required for monitored object creation: https://learn.microsoft.com/en-gb/answers/questions/1009482/azure-monitor-agent-on-workstation[learn.microsoft](https://learn.microsoft.com/en-gb/answers/questions/1009482/azure-monitor-agent-on-workstation)

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.