From Dev.to
Least-privilege Azure RBAC for read-only architecture review
TL;DR: Least-privilege Azure RBAC for a read-only architecture scanner is the Reader action */read plus two actions: Microsoft.Resources/deployments/exportTemplate/action and Microsoft.Network/network...