Azure Monitor's metrics are pulled through a service principal with reader access, the Azure equivalent of AWS's read-only IAM role approach.
In Azure AD, register a new application for Linivo and generate a client secret (or use a certificate, where your policy prefers it) for authentication.
Grant the service principal the built-in Reader role at the subscription or resource-group level; it needs read access to metrics and resource metadata, nothing that can modify infrastructure.
Provide the tenant ID, application ID and client secret; Linivo discovers VMs, databases and other monitored resource types within the scoped subscription or resource groups automatically.