Comment by IcyWindows

The caller still needs at least the Reader role, so it was limited to accounts that were added to the Azure subscription as only Readers.

I'm glad they fixed it, but this doesn't seem too scary??