diff --git a/.github/workflows/azure-static-web-apps-gray-sand-07a10f403.yml b/.github/workflows/azure-static-web-apps-gray-sand-07a10f403.yml
index c1747b153..7c39aebfd 100644
--- a/.github/workflows/azure-static-web-apps-gray-sand-07a10f403.yml
+++ b/.github/workflows/azure-static-web-apps-gray-sand-07a10f403.yml
@@ -14,6 +14,13 @@ jobs:
     if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.action != 'closed')
     runs-on: ubuntu-latest
     name: Build and Deploy Job
+    permissions:
+      actions: read
+      contents: read
+      deployments: read
+      packages: none
+      pull-requests: write
+      security-events: write
     steps:
       - uses: actions/checkout@v2
         with: