diff --git a/plugins/azure-sites-backend/api-report.md b/plugins/azure-sites-backend/api-report.md
index 04cd22596a..900a14fbc2 100644
--- a/plugins/azure-sites-backend/api-report.md
+++ b/plugins/azure-sites-backend/api-report.md
@@ -62,7 +62,7 @@ export interface RouterOptions {
   // (undocumented)
   logger: Logger;
   // (undocumented)
-  permissions: PermissionEvaluator;
+  permissions?: PermissionEvaluator;
 }
 
 // (No @packageDocumentation comment for this package)
diff --git a/plugins/azure-sites-backend/src/service/router.ts b/plugins/azure-sites-backend/src/service/router.ts
index fcab14a97f..0a05009f95 100644
--- a/plugins/azure-sites-backend/src/service/router.ts
+++ b/plugins/azure-sites-backend/src/service/router.ts
@@ -39,7 +39,7 @@ export interface RouterOptions {
   logger: Logger;
   azureSitesApi: AzureSitesApi;
   catalogApi: CatalogApi;
-  permissions: PermissionEvaluator;
+  permissions?: PermissionEvaluator;
 }
 
 /** @public */
@@ -84,15 +84,17 @@ export async function createRouter(
           throw new NotAllowedError();
         }
 
-        const decision = (
-          await permissions.authorize(
-            [{ permission: azureSitesActionPermission, resourceRef }],
-            {
-              token,
-            },
-          )
-        )[0];
-        if (decision.result === AuthorizeResult.DENY) {
+        const decision = permissions
+          ? (
+              await permissions.authorize(
+                [{ permission: azureSitesActionPermission, resourceRef }],
+                {
+                  token,
+                },
+              )
+            )[0]
+          : undefined;
+        if (decision && decision.result === AuthorizeResult.DENY) {
           throw new NotAllowedError('Unauthorized');
         }
 
@@ -133,15 +135,17 @@ export async function createRouter(
           throw new NotAllowedError();
         }
 
-        const decision = (
-          await permissions.authorize(
-            [{ permission: azureSitesActionPermission, resourceRef }],
-            {
-              token,
-            },
-          )
-        )[0];
-        if (decision.result === AuthorizeResult.DENY) {
+        const decision = permissions
+          ? (
+              await permissions.authorize(
+                [{ permission: azureSitesActionPermission, resourceRef }],
+                {
+                  token,
+                },
+              )
+            )[0]
+          : undefined;
+        if (decision && decision.result === AuthorizeResult.DENY) {
           throw new NotAllowedError('Unauthorized');
         }