To 'Read a storage account', ie. list the blobs in the storage account, you need an 'Action' permission.
To read the data in a storage account, ie. open a blob, you need a 'DataAction' permission.
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/role-definitions

You need to assign the user the Key Vault Secrets Officer role.
In the Azure portal, type Key Vaults in the search box, select Key Vaults from the search results then select KeyVault11641655. Alternatively, browse to Key Vaults in the left navigation pane.
In the key vault properties, select Access control (IAM).
In the Add a role assignment section, click the Add button.
In the Role box, select the Key Vault Secrets Officer role from the drop-down list.
In the Select box, start typing User2-11641655 and select User2-11641655 from the search results.
Click the Save button to save the changes.

Reference:
https://docs.microsoft.com/en-us/azure/security-center/custom-security-policies

When automatic provisioning is enabled, Security Center provisions the Microsoft Monitoring Agent on all supported Azure VMs and any new ones that are created.
Supported Operating systems include: Ubuntu 14.04 LTS (x86/x64), 16.04 LTS (x86/x64), and 18.04 LTS (x64) and Windows Server 2008 R2, 2012, 2012 R2, 2016, version 1709 and 1803.
Reference:
https://docs.microsoft.com/en-us/azure/security-center/security-center-faq