The Owner role is a very high-level role that grants full access to manage all resources in the scope, including the ability to assign roles to other users. This role does not follow the principle of least privilege, which means that you should only grant the minimum level of access required to accomplish the goal.
To enable Traffic Analytics for an Azure subscription, you need to have a role that grants you the following permissions at the subscription level:
* Microsoft.Network/applicationGateways/read
* Microsoft.Network/connections/read
* Microsoft.Network/loadBalancers/read
* Microsoft.Network/localNetworkGateways/read
* Microsoft.Network/networkInterfaces/read
* Microsoft.Network/networkSecurityGroups/read
* Microsoft.Network/publicIPAddresses/read
* Microsoft.Network/routeTables/read
* Microsoft.Network/virtualNetworkGateways/read
* Microsoft.Network/virtualNetworks/read
* Microsoft.OperationalInsights/workspaces/*
Some of the built-in roles that have these permissions are Owner, Contributor, or Network Contributor1.
However, these roles also grant other permissions that may not be necessary or desirable for enabling Traffic Analytics. Therefore, the best practice is to use the principle of least privilege and create a custom role that only has the required permissions for enabling Traffic Analytics2.
Therefore, to meet the goal of ensuring that an Azure AD user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription, you should create a custom role with the required permissions and assign it to Admin1 at the subscription level.