Mods
Azure

IAM Role: Azure/Network Watcher/operator

PermissionGrant
microsoft.network/networkwatchers/nexthop/actionoperator
microsoft.network/networkwatchers/querytroubleshootresult/actionoperator
microsoft.network/networkwatchers/troubleshoot/actionoperator
microsoft.network/networkwatchers/packetcaptures/stop/actionoperator
microsoft.network/networkwatchers/packetcaptures/writeoperator
microsoft.network/networkwatchers/packetcaptures/deleteoperator
microsoft.resources/deployments/cancel/actionoperator
microsoft.resources/deployments/deleteoperator
microsoft.resources/deployments/validate/actionoperator
microsoft.resources/deployments/writeoperator
microsoft.network/networkwatchers/queryflowlogstatus/actionreadonly
microsoft.network/networkwatchers/securitygroupview/actionreadonly
microsoft.network/networkwatchers/topology/actionreadonly
microsoft.network/networkwatchers/readmetadata
microsoft.network/networkwatchers/networkconfigurationdiagnostic/actionmetadata
microsoft.network/networkwatchers/queryconnectionmonitors/actionmetadata
microsoft.network/networkwatchers/connectivitycheck/actionmetadata
microsoft.network/networkwatchers/azurereachabilityreport/actionmetadata
microsoft.network/networkwatchers/availableproviderslist/actionmetadata
microsoft.network/networkwatchers/packetcaptures/querystatus/actionmetadata
microsoft.network/networkwatchers/packetcaptures/readmetadata
microsoft.network/networkwatchers/connectionmonitors/start/actionmetadata
microsoft.network/networkwatchers/connectionmonitors/stop/actionmetadata
microsoft.network/networkwatchers/connectionmonitors/query/actionmetadata
microsoft.network/networkwatchers/connectionmonitors/readmetadata
microsoft.network/networkwatchers/lenses/start/actionmetadata
microsoft.network/networkwatchers/lenses/stop/actionmetadata
microsoft.network/networkwatchers/lenses/query/actionmetadata
microsoft.network/networkwatchers/lenses/readmetadata
microsoft.network/networkwatchers/connectionmonitors/providers/microsoft.insights/metricdefinitions/readmetadata
microsoft.network/networkwatchers/pingmeshes/start/actionmetadata
microsoft.network/networkwatchers/pingmeshes/stop/actionmetadata
microsoft.network/networkwatchers/pingmeshes/readmetadata
microsoft.network/networkwatchers/flowlogs/readmetadata
microsoft.resources/deployments/operations/readmetadata
microsoft.resources/deployments/readmetadata
microsoft.resources/subscriptions/resourcegroups/readmetadata