During review of ARO MiWi permissions, some permissions in the Network Operator CredentialsRequest for Azure having other permissions identified through a linked action that are missing.

A linked access check is an action performed by Azure Resource Manager during a incoming request. For example, when you issue a create operation to a network interface ( Microsoft.Network/networkInterfaces/write ) you specify a subnet in the payload. ARM parses the payload, sees you're setting a subnet property, and as a result requires the linked access check Microsoft.Network/virtualNetworks/subnets/join/action to the subnet resource specified in the network interface. If you update a resource but don't include the property in the payload, it will not perform the permission check.

The following permissions were identified as possibly needed in Network Operator CredsRequest as they are specified as linked action of one of Network Operator's existing permissions

"Microsoft.Network/applicationGateways/backendAddressPools/join/action"
"Microsoft.Network/applicationSecurityGroups/joinIpConfiguration/action"
"Microsoft.Network/loadBalancers/backendAddressPools/join/action"
"Microsoft.Network/loadBalancers/frontendIPConfigurations/join/action"
"Microsoft.Network/loadBalancers/inboundNatRules/join/action"
"Microsoft.Network/networkInterfaces/join/action"
"Microsoft.Network/networkSecurityGroups/join/action"
"Microsoft.Network/publicIPAddresses/join/action"
"Microsoft.Network/virtualNetworks/subnets/join/action"

Each permission needs to be validated as to whether it is needed by Network Operator through any of its code paths.