Why are Azure Monitor System permissions not shown in the IAM section?

Hello Julian Bednarz

Thank you for your question!

The reason you don't see the Azure Monitor System service principal in the IAM section is because it's not using traditional RBAC permissions.

The question is, if it has permissions to upload content, why is it not explicitly shown in the IAM section?

what you see in IAM is explicit role assignments to users, groups, service principals, or managed identities shows up in the "Access control (IAM)" blade Examples: Storage Blob Data Contributor, Reader, etc.

what Azure Monitor uses is to Built-in exceptions for Microsoft first-party services and Operates at the Azure Resource Manager level, not RBAC level this is why it doesn't appear in IAM because it's not an RBAC assignment.

When you enable "Allow Azure services on the trusted services list," you're essentially creating a network-level exception that allows these pre-approved Microsoft services to bypass both:

• Network access restrictions
• RBAC permission checks

This is why the Azure Monitor System service principal can write to your storage account without appearing in your IAM list - it's using a different, more fundamental permission pathway that operates below the RBAC layer.

Hope the above answer helps! Please let us know do you have any further queries I'm here to help.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members. 

Hi @Julian Bednarz

The Service Principal "Azure Monitor System" is likely a built-in service principal in Azure that is used by Azure Monitor to interact with other Azure resources, such as Log Analytics Workspaces and Storage Accounts.

When you enable the "Allow Azure services on the trusted services list to access this storage account" option, you're essentially granting access to a set of pre-defined Azure service principals, including Azure Monitor. This allows Azure Monitor to access your Storage Account without requiring explicit permissions in the IAM section.

In this case, the Azure Monitor service principal is not explicitly shown in the IAM section because it's not a traditional service principal that you would create and manage yourself. Instead, it's a built-in service principal that's part of the Azure platform.

The permissions for Azure Monitor to access your Storage Account are granted implicitly through the "trusted services" mechanism, which allows specific Azure services to access your resources without requiring explicit role assignments.

To confirm this, you can check the Azure documentation on trusted services and service principals. It should provide more information on how Azure services interact with each other and how permissions are granted in these scenarios.

In summary, the Azure Monitor service principal has permissions to upload content to your Storage Account because it's a trusted service, not because it's explicitly listed in the IAM section.