What permissions do you need in order to be able to execute Network Watcher IP flow verify check?

You need to have action Microsoft.Network/networkWatchers/ipFlowVerify/action over scope of your Network Watcher resource in a specific region.

The NetworkWatcher resources are by default created in the NetworkWatcherRG resource group with name NetworkWatcher suffixed by _{regionName}.

/subscriptions/{subscriptionId}/resourceGroups/NetworkWatcherRG/providers/Microsoft.Network/networkWatchers/NetworkWatcher_{regionName}