Update azure-monitor-data-explorer-proxy.md

[sandervandevelde]

The rights to the Log Analytics Workspace must always be added, even if those tables are not queried (eg. when only ADX tables are queried).

[prmerger-automator]

@sandervandevelde : Thanks for your contribution! The author(s) have been notified to review your proposed change.

[learn-build-service-prod]

Learn Build status updates of commit 01d7e90:

✅ Validation status: passed

File	Status	Preview URL	Details
articles/azure-monitor/logs/azure-monitor-data-explorer-proxy.md	✅Succeeded

For more details, please refer to the build report.

For any questions, please:

• Try searching the learn.microsoft.com contributor guides
• Post your question in the Learn support channel

[Jak-MS]

@guywi-ms

• Can you review this PR?
• IMPORTANT: When this content is ready to merge, you must add #sign-off in a comment or the approval may get overlooked.

#label:"aq-pr-triaged"
@MicrosoftDocs/public-repo-pr-review-team

[guywi-ms]

@sandervandevelde Thanks for your dedication to our documentation! I would like to better understand the clarification that's required. Can you please provide a bit more context about the scenario in which you feel the current documentation is ambiguous? I'm hesitant to change the wording to "your alert needs explicit..." since this article applies to all cross-service queries, including those not used by an alert.

[sandervandevelde]

Hello @guywi-ms ,

My concerns are that the permission prerequisites here are given without any context.

Yes, the need for Azure Resource Graph permissions and Azure Data Explorer permissions are clear if you want to access those resources.

The permissions for the Log Analytics workspaces are needed because the scope is set with a cross-service query in mind.

If someone only want to use the Azure Data Explorer, the Log Analytics workspace permissions must be set because that Log Analytics workspace scope should be set according to the documentation.

but that permission is not needed if the scope is set to the ADX cluster itself.

Thus, that relationship between permission prerequisites and scope selection was not clear to me.

I would like to see this relatinoship is stated more explicitly.

[guywi-ms]

Hi @sandervandevelde,
Thank you very much for the clarification! This is very helpful. 👍
I have created a separate PR to clarify in a few places throughout the article that the article deals with querying Azure Data Explorer and Resource Graph from a Log Analytics workspace (and as a note, that you can also create cross-service queries from these other services).
Thanks again for your contribution!

#please-close