User needs to have read only access to two subscriptions, so added user to the Access Control for both subscriptions and gave them the built in role [Readers]. Basically I want the user to be able to view Application Insights but not to create, delete, update anything else.
The user reported that they could not AI and instead saw this.
Digging into this error I got this documentation from MS.
The pertinent information is:
These items require write access to the whole Resource group that contains your website:
TLS/SSL Certificates and bindings (TLS/SSL certificates can be shared between sites in the same resource group and geo-location)
Alert rules
Autoscale settings
Application insights components
Web tests
I think the best way to proceed is to create a role that is the same as the built in Reader, and then assign write rights to Application Insights, add this role to the user, and remove the built-in reader. I am knew to Azure and would appreciate any advice or recommendation.
