diff --git a/scripts/azure_onboarding/azure_onboarding.ps1 b/scripts/azure_onboarding/azure_onboarding.ps1
index d6eec3b..e0a1243 100644
--- a/scripts/azure_onboarding/azure_onboarding.ps1
+++ b/scripts/azure_onboarding/azure_onboarding.ps1
@@ -240,6 +240,7 @@ function New-FireflyCustomRole {
                     "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
                     "Microsoft.Web/sites/config/list/Action",
                     "Microsoft.Cache/redis/listKeys/action"
+                    "Microsoft.AppConfiguration/configurationStores/ListKeys/action"
     $role.DataActions = "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
     $role.AssignableScopes = '/subscriptions/'+$subscriptionId
     New-AzRoleDefinition -Role $role