What #Azure permissions do you need to run #terraform plan?

People use separate identities for running terraform plan and apply, but what permissions are needed to run terraform plan? It's really easy to create a custom role to help maintain least privilege!