Comment 2 for bug 1929619

Workaround:
Find the LB-manager role definition:

az role definition list -o table|grep juju-charm-lb-manager
az role definition list --name $role-name-uuid --output json > lb-role.json
vi lb-role.json
  # remove the surrounding [ ] list brackets from top and bottom lines
  # add a comma after the last Actions section item, and add this line within Actions:
  "Microsoft.Network/networkSecurityGroups/read"
  # save the file and quit vi
az role definition update --role-definition ./lb-role.json