Discovery Reader — subscription scope
Reads AKS resource facts, data collection rule associations, data collection rules, and Azure Monitor account metadata. It does not include evidence metric querying.
Microsoft.ContainerService/managedClusters/readMicrosoft.Insights/DataCollectionRuleAssociations/ReadMicrosoft.Insights/DataCollectionRules/ReadMicrosoft.Monitor/accounts/read
Evidence Reader — enrolled AKS resource scope
Reads cluster facts, node-pool facts, and authorizes resource-scoped metric queries.
Microsoft.ContainerService/managedClusters/readMicrosoft.ContainerService/managedClusters/agentPools/readMicrosoft.Insights/Metrics/Read
Role definition is not assignment scope
A role can be defined for use in a subscription while its assignment is limited to one AKS resource. Both reviewed role definitions have empty DataActions and no write or delete actions. Empty DataActions does not mean no metrics are read: Metrics/Read is in the action list.
Review the actual grant
These action lists describe the reviewed configuration. Before granting access, check the actual role definition and assignments shown for your environment. Compare the portal’s current guidance and Azure assignments. Git access requires separate permissions and is not covered by these Azure roles.