diff --git a/.github/workflows/generate-azure-consts.yaml b/.github/workflows/generate-azure-consts.yaml
index 71b78ebea..5add09bb7 100644
--- a/.github/workflows/generate-azure-consts.yaml
+++ b/.github/workflows/generate-azure-consts.yaml
@@ -7,6 +7,8 @@ jobs:
   generate-azure-consts:
     if: github.repository == 'Azure/aks-engine-azurestack'
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write 
     steps:
       - uses: actions/checkout@v3
       - name: install go
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e15a107a6..ea5d91281 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -38,6 +38,8 @@ jobs:
   build:
     needs: validate-no-egress
     runs-on: ubuntu-latest
+    permissions:
+      contents: write 
     steps:
       - name: Checkout
         uses: actions/checkout@v3
diff --git a/.github/workflows/update-go-mod-vendor.yaml b/.github/workflows/update-go-mod-vendor.yaml
index 23978fc79..0ebf304dc 100644
--- a/.github/workflows/update-go-mod-vendor.yaml
+++ b/.github/workflows/update-go-mod-vendor.yaml
@@ -7,6 +7,8 @@ jobs:
   update-go-mod-vendor:
     if: github.repository == 'Azure/aks-engine-azurestack'
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write 
     steps:
       - uses: actions/checkout@v3
       - name: install go