Skip to main content

Onboarding Azure subscription(s)

Important

You need a Global Administrator Access in Azure in order to perform a Tenant-level onboarding.

To integrate an Azure tenant, follow these steps:

  1. Under Scan Configuration, select Add Azure Subscription(s).

    image1.png

    The Setting up Azure AD application and permissions window is displayed.

  2. Select the Azure AD application you want to use:

    • If you do not have a pre-existing Azure AD application you want to use, follow this procedure to set up a new one and manually fill in the required information.

    • If you have a pre-existing Azure AD application, click the drop-down menu under Select a pre-existing Azure AD application and select the application you want to use, and click Next.

  3. Select the subscription(s) you want to onboard and click the Add button.

    CSPM_Azure_select_subscriptions_to_onboard_589653_en.png

    Scan Configuration page is automatically displayed and you can view the accounts you onboarded.

Create a new Azure AD application

  1. Open a new browser tab or window and log in to the Azure Portal with an administrator account.

  2. Create an Azure AD application from your Azure Portal:

    1. Navigate to App registrations.

      CSPM_Azure_app_reg_412812_en.png

    2. Click New registration.

      CSPM_Azure_new_reg_412812_en.png

      The Register an application window is displayed.

    3. Type in a descriptive name for the application under Name.

    4. Click Register:

      CSPM_Azure__reg_name_412812_en.png

      The new application is displayed:

      CSPM_Azure__reg_created_412812_en.png

  3. Copy the Display name, Application (client) ID, and Directory (tenant) ID.

  4. Go back to the Scan Configuration browser page and paste the information copied at step 5.

  5. Add API permissions to the application:

    1. Click the API permissions link in the menu on the left side of the page.

      The API permissions page is displayed.

    2. Click + Add permission.

      CSPM_Azure_API_permissions_412812_en.png

      The Request API permissions window is displayed.

    3. Select Microsoft Graph.

      CSPM_Azure_API_permissions_graph_412812_en.png

      The Microsoft Graph permissions page is displayed.

    4. Click on Application permissions.

      CSPM_Azure_API_permissions_graph_1_412812_en.png

      A list of available permissions is displayed.

    5. Add the following permissions:

      • User.Read.All

      • Group.Read.All

      • Application.Read.All

      • UserAuthenticationMethod.Read.All

    6. Click Add permissions.

      CSPM_Azure_API_permissions_graph_2_412812_en.png

      The Configured permissions window is displayed.

    7. Click Grant admin consent for Default Directory.

      CSPM_Azure_API_permissions_admin_412812_en.png

      If you require assistance getting the necessary permissions, refer to this Azure article.

  6. Set up a Client secret:

    1. Click the Certificates & secrets link in the menu on the left side of the page.

    2. Click + New client secret.

      CSPM_Azure_API_add_secret_412812_en.png

      The Add a client secret window is displayed.

    3. Type in an easily identifiable description in the Description field.

    4. Set the Expires setting to 24 months.

      Note

      When the client secret expires you will have to create a new one and manually add it to the integration.

    5. Click Add.

      CSPM_Azure_API_add_secret_2_412812_en.png

      Important

      Do not close or refresh the window until the update is finished.

  7. Copy the value under the Value column of the newly created Client secret.

  8. Go back to the Scan Configuration browser page and paste the information copied at step 7.

  9. Click Next

  10. Select one of the following options:

ARM Deployment

  1. Click the Deploy ARM template button.

    image20.png

    The Custom deployment page will be displayed in a new browser window.

  2. Configure the custom deployment settings:

    1. Under Project details, select the Subscription you want to use.

    2. Select the region where your cloud account is located.

    3. Type in a descriptive name for the role.

    4. Click Review + create.

    5. Review the displayed information and click Create.

      Important

      Do not close or refresh the window until the update is finished.

    Note

    Refer to this article if you encounter any error during deployment. A common reason is AuthorizationFailed due to missing microsoft/resources/deployments/validate/action" rights.

    image21.png

Manual

  1. Open a new browser tab or window and log in to the Azure Portal with a Tenant-level administrator account.

  2. Go to the Management Groups page and select the Management Group you would like to configure.

    Tip

    To ensure you this application will have access to all Management Groups and Subscriptions under it, you should select the highest level Management Group possible (i.e: Tenant Root Group).

    image2.png

  3. Go to the Access control (IAM) page.

  4. Click the + Add button and select Add custom role.

    image4.png

  5. In the Basics tab fill in the following information:

    • Under Custom role name type in a unique identifier for the role.

    • In the Description field add in information that will make the role easily identifiable.

  6. Go to the JSON tab and click the Edit button.

  7. Go back to the Selecting an Azure subscription browser page and copy the "permissions” parameter.

  8. Go back to the JSON tab and paste it over the same parameter.

  9. Click the Save button on the upper right side of section.

    image5.png

  10. Click the Review + create button on the lower left side of the page.

  11. Click the Create button on the lower left side of the page.

    The Access control (IAM) page is displayed.

  12. Click the + Add button and select Add role assignment.

    image6.png

    The Add role assignment page is displayed.

  13. Click on the name of the role you created earlier in step 5.

  14. Click the Next button in the lower side of the page.

    image7.png

    The Add role assignment page is displayed.

  15. Under the Members tab, click + Select members.

    image8.png

  16. Select the name of the application for this connection.

  17. Click the Review + assign button on the lower left side of the page.

  18. Go back to the Selecting an Azure subscription browser page.

  19. Select the Azure subscription you want to use from the Select an Azure subscription option.

  20. Click the Add account button.

In this section: