Mods
Azure

IAM Role: Azure/Firewall/admin

PermissionGrant
microsoft.network/azurefirewalls/writeadmin
microsoft.network/azurefirewalls/deleteadmin
microsoft.resources/deployments/cancel/actionadmin
microsoft.resources/deployments/deleteadmin
microsoft.resources/deployments/validate/actionadmin
microsoft.resources/deployments/writeadmin
microsoft.network/azurefirewalls/providers/microsoft.insights/metricdefinitions/readmetadata
microsoft.network/azurefirewalls/providers/microsoft.insights/logdefinitions/readmetadata
microsoft.network/azurefirewalls/readmetadata
microsoft.resources/deployments/operations/readmetadata
microsoft.resources/deployments/readmetadata
microsoft.resources/subscriptions/resourcegroups/readmetadata