--- title: Keeping a Short Leash: New AzureHound Least-Privilege... description: AzureHound, the Microsoft Entra ID and Azure Resource Manager data collector for BloodHound, now has documented least-privilege permissions, replacing the... canonical: https://daily.dev/posts/keeping-a-short-leash-new-azurehound-least-privilege-documentation-dsvnvzheb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Keeping a Short Leash: New AzureHound Least-Privilege Documentation | daily.dev og:description: AzureHound, the Microsoft Entra ID and Azure Resource Manager data collector for BloodHound, now has documented least-privilege permissions, replacing the... og:url: https://daily.dev/posts/keeping-a-short-leash-new-azurehound-least-privilege-documentation-dsvnvzheb og:image: https://api.daily.dev/og/posts/dSvNvZhEb.png og:image:alt: Keeping a Short Leash: New AzureHound Least-Privilege Documentation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Keeping a Short Leash: New AzureHound Least-Privilege Documentation **[SpecterOps](https://daily.dev/sources/specterops)** · 12 min read · 0 upvotes · 0 comments ## Summary AzureHound, the Microsoft Entra ID and Azure Resource Manager data collector for BloodHound, now has documented least-privilege permissions, replacing the previous broad guidance of Directory.Read.All, RoleManagement.Read.All, AuditLog.Read.All, and the built-in Reader role at the Tenant Root Management Group. The research inventoried all 17 MS Graph and 17 ARM endpoints AzureHound calls, mapped each to the narrowest valid permission through documentation review and empirical testing, and validated the result via a permission matrix harness and full collection output comparisons between broad and least-privilege service principals. The outcome collapses MS Graph access into eight granular application permissions and defines a custom 'AzureHound Reader' Azure RBAC role with 16 specific read actions, while noting that broader permissions remain a valid tradeoff to reduce maintenance across future releases. New reference documentation and updated manual/scripted deployment steps are now published, with no forced migration for existing deployments. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the least-privilege Microsoft Graph permissions needed for AzureHound instead of Directory.Read.All? Eight granular Microsoft Graph application permissions replace the previous Directory.Read.All, RoleManagement.Read.All, and AuditLog.Read.All permissions. Examples include GroupMember.Read.All instead of Group.Read.All, and RoleManagement.Read.Directory instead of the broader RoleManagement.Read.All, since AzureHound only needs Entra ID directory role-management data, not the full role management scope. _Track AzureHound permission changes like these on daily.dev before rolling out a BloodHound deployment._ ### What Azure RBAC role should be assigned to AzureHound instead of the built-in Reader role? A custom 'AzureHound Reader' role with 16 specific read actions replaces the built-in Reader role, which grants a wildcard */read action across the entire control plane at the Tenant Root Management Group. The custom role maps each of AzureHound's 17 ARM endpoints to its exact required action, such as Microsoft.Compute/virtualMachines/read, avoiding read access to unrelated resource providers. _Developers hardening cloud service principals can follow least-privilege scoping guidance like this on daily.dev._ ### Do I need to migrate my existing AzureHound deployment to the new least-privilege permissions immediately? No, existing AzureHound deployments are not required to migrate immediately to the least-privilege permission set. The narrower permissions are the security recommendation because they reduce standing access exposure if the AzureHound service principal is compromised, but organizations may keep broader read permissions to reduce maintenance overhead as new collector versions are released, as long as it's a deliberate choice. _Keep up with tool permission tradeoffs like AzureHound's on daily.dev when planning security upgrades._ ## Similar posts on daily.dev - [Azure RBAC Explained: Roles, Scope, and Why Least Privilege Breaks Down](https://daily.dev/posts/azure-rbac-explained-roles-scope-and-why-least-privilege-breaks-down-9tszskjro) · Security Boulevard · 0 upvotes · 0 comments - [Cloud Discovery With AzureHound](https://daily.dev/posts/cloud-discovery-with-azurehound-qhryprbek) · Unit 42 · 0 upvotes · 0 comments - [No single pane of glass: Anatomy of an Azure permission takeover](https://daily.dev/posts/no-single-pane-of-glass-anatomy-of-an-azure-permission-takeover-q7x1g2hf6) · Sysdig Blog · 0 upvotes · 0 comments - [AWSHound: An OpenSource AWS OpenGraph Collector](https://daily.dev/posts/awshound-an-opensource-aws-opengraph-collector-nvxm1hffc) · SpecterOps · 1 upvotes · 0 comments - [Privilege Hygiene: Least Privilege Best Practices Guide](https://daily.dev/posts/privilege-hygiene-least-privilege-best-practices-guide-pegfoizoi) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#azure](https://daily.dev/tags/azure), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/keeping-a-short-leash-new-azurehound-least-privilege-documentation-dsvnvzheb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Keeping a Short Leash: New AzureHound Least-Privilege Documentation","url":"https://daily.dev/posts/keeping-a-short-leash-new-azurehound-least-privilege-documentation-dsvnvzheb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/keeping-a-short-leash-new-azurehound-least-privilege-documentation-dsvnvzheb"},"datePublished":"2026-08-23T12:16:30.344Z","dateModified":"2026-08-23T12:18:44.048Z","description":"AzureHound, the Microsoft Entra ID and Azure Resource Manager data collector for BloodHound, now has documented least-privilege permissions, replacing the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aaa015c75fd5774dbdb8a93fd25d5c8b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aaa015c75fd5774dbdb8a93fd25d5c8b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SpecterOps","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SpecterOps","logo":"https://media.daily.dev/image/upload/s--lR36Z4gn--/f_auto,q_auto/v1787487384/logos/specterops?_a=BAMAMicg0","url":"https://daily.dev/sources/specterops"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/keeping-a-short-leash-new-azurehound-least-privilege-documentation-dsvnvzheb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,azure,authentication","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SpecterOps","item":"https://daily.dev/sources/specterops"},{"@type":"ListItem","position":3,"name":"Keeping a Short Leash: New AzureHound Least-Privilege Documentation"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/keeping-a-short-leash-new-azurehound-least-privilege-documentation-dsvnvzheb#faq","mainEntity":[{"@type":"Question","name":"What are the least-privilege Microsoft Graph permissions needed for AzureHound instead of Directory.Read.All?","acceptedAnswer":{"@type":"Answer","text":"Eight granular Microsoft Graph application permissions replace the previous Directory.Read.All, RoleManagement.Read.All, and AuditLog.Read.All permissions. Examples include GroupMember.Read.All instead of Group.Read.All, and RoleManagement.Read.Directory instead of the broader RoleManagement.Read.All, since AzureHound only needs Entra ID directory role-management data, not the full role management scope. Track AzureHound permission changes like these on daily.dev before rolling out a BloodHound deployment."}},{"@type":"Question","name":"What Azure RBAC role should be assigned to AzureHound instead of the built-in Reader role?","acceptedAnswer":{"@type":"Answer","text":"A custom 'AzureHound Reader' role with 16 specific read actions replaces the built-in Reader role, which grants a wildcard */read action across the entire control plane at the Tenant Root Management Group. The custom role maps each of AzureHound's 17 ARM endpoints to its exact required action, such as Microsoft.Compute/virtualMachines/read, avoiding read access to unrelated resource providers. Developers hardening cloud service principals can follow least-privilege scoping guidance like this on daily.dev."}},{"@type":"Question","name":"Do I need to migrate my existing AzureHound deployment to the new least-privilege permissions immediately?","acceptedAnswer":{"@type":"Answer","text":"No, existing AzureHound deployments are not required to migrate immediately to the least-privilege permission set. The narrower permissions are the security recommendation because they reduce standing access exposure if the AzureHound service principal is compromised, but organizations may keep broader read permissions to reduce maintenance overhead as new collector versions are released, as long as it's a deliberate choice. Keep up with tool permission tradeoffs like AzureHound's on daily.dev when planning security upgrades."}}]} ```