Help: Agentless scanning is missing resources in our Azure subscription.

Our CloudGuard posture management shows only 60% of our Azure resources. The agentless scan is missing entire resource groups, including key storage accounts and App Service plans.

We're paying for full subscription coverage. This gap creates a false sense of security and makes our compliance reports useless.

Our setup:
* Single Azure tenant, one subscription.
* CloudGuard connector uses a Service Principal with `Reader` role on the entire subscription.
* Resources are in supported regions (mostly East US, West Europe).

Has anyone else had to manually adjust permissions beyond `Reader`? Is there a known issue with nested management groups or specific resource types?