Skip to main content

Microsoft Azure

Integrate Microsoft Azure

You can integrate GravityZone with Microsoft Azure and protect your virtual machines hosted in the Microsoft cloud.

Prerequisites:

  • Azure application with Reader permission

  • Active Directory ID

  • Application ID

  • Application Secret

For details about obtaining the required credentials and setting up the Azure application, refer to Configure Microsoft Azure application for GravityZone integration.

You can create several Microsoft Azure integrations. For each integration, you must have a valid Active Directory ID.

To set up integration with Microsoft Azure:

  1. Go to the Configuration page in Control Center and click the Virtualization Providers tab.

  2. Click the add.png Add button at the upper side of the table and choose Azure Integration from the menu. A configuration window will appear.

  3. Specify the Azure integration details:

    • The integration name. When adding several Azure integrations, you can identify them by name.

    • Active Directory ID. Each instance of Azure Active Directory has a unique identifier available in the Microsoft Azure account details.

    • Application ID. Each Azure application has a unique identifier available in the application details.

    • Application Secret. The application secret is the value displayed when saving a key in the Azure application settings.

  4. Select the option Restrict policy assignment from the network view to change the policy only from the Virtual Machines view. If deselected, you can change the policy from the Computers and Virtual Machines view.

  5. Click Save. If the provided credentials are valid, the integration will be created and added to the grid.

Wait a few moments while GravityZone synchronizes with the Microsoft Azure inventory.

Configure Microsoft Azure application for GravityZone integration

This section aims to explain how to configure an Azure application to integrate GravityZone with Microsoft Azure.

Through GravityZone (on-premises solution) integration with Microsoft Azure, you are able to import into Control Center the existing inventory of virtual machines hosted in the Microsoft cloud.

The integration requires registering in Azure a web application that provides GravityZone the ability to access data from Azure virtual machines. The Azure application also provides the necessary credentials to configure the integration in Control Center:

  • Active Directory ID

  • Application ID

  • Application Secret

For details on how to use these credentials after you have created the application, refer to the Configuring Bitdefender Cloud single sign-on with Azure AD section.

Requirements

To create an application, first make sure that you have the necessary Azure AD and subscription permissions.

Azure AD permissions

You need Azure AD permissions to access Azure Active Directory and to register the application.

To check the Azure AD permissions:

  1. Log in to Microsoft Azure Portal.

  2. Select Azure Active Directory.

  3. In the Overview section, observe your role. For example, if you are an administrator, you can manage all aspects of app registrations. Refer to Microsoft Azure documentation for available roles and role permissions.

  4. In the left pane, select User settings.

  5. View the App registrations setting. If the value is Yes, then any user in the Azure directory can register an application. If the value is No, then only users with an administrator role can register an application. Only an administrator can change the value for App registrations.

Azure subscription permissions

In your Azure subscription, you need to have Microsoft.Authorization/*/Write access to assign a role to the application. This action requires the Owner role or User Access Administrator role.

To check the subscription permissions:

  1. Search for and select Subscriptions, or click Subscriptions on the Home page.

  2. Select the subscription that you want to associate with the application. If you do not see the subscription, select global subscriptions filter.

  3. Select My permissions and select Click here to view complete access details for this subscription.

    02-user-permissions.png

  4. Click Role assignments and view your roles. If the case, use the filtering boxes to find your account. If you do not have the required permissions to assign a role to the application, contact your administrator.

Configuring an Azure application

Register the application

To register an Azure application:

  1. Log in to Microsoft Azure Portal.

  2. Select Azure Active Directory.

  3. Select App registrations.

  4. Select New registration.

    03-app-register.png

  5. Enter a name for the application.

    04-create-app.png

  6. Under Redirect URl (optional), select Web and enter the URL of the GravityZone instance that you integrate with Azure.

  7. Click Register.

    05-details.png

Once created, the application displays in the Overview section two of the three values required for GravityZone integration:

  • Application (client) ID

  • Directory (tenant) ID

Assign a role to the application

You must assign a Reader role to the application to access resources in your subscription.

  1. Search for and select Subscriptions, or click Subscriptions on the Home page.

  2. Select the subscription that you want to associate with the application.

  3. Select Access control (IAM).

    06-add-role-assign.png

  4. Click Add and select Add role assignment.

  5. Under Role, select Reader.

    07-role-reader.png

  6. Select Azure AD user, group, or service principal.

  7. Select the application you have created.

  8. Click Save.

Create an application secret

To integrate GravityZone with Azure, you also need the application secret.

  1. Select Azure Active Directory.

  2. Go to App registrations and select your application.

  3. Select Certificates & secrets.

    08-secret.png

  4. Under Client secrets, click New client secret.

  5. Enter a description, select the duration and click Add.

    Caution

    After the secret expires, the synchronization between the Microsoft Azure and GravityZone inventories will not be possible. In this case, you must use another secret for integration.

  6. Back under Client secrets, a key value is displayed. This value represents the application secret required for GravityZone integration.

    Use the Copy to clipboard option and keep the value in a safe location. You will not be able to retrieve this value later.

    09-secret-done.png

Microsoft provides additional information on creating an Azure application: How to: Use the portal to create an Azure AD application and service principal that can access resources

Create the Azure Application

  1. Log in to Microsoft Azure portal.

  2. On the right upper-side, click the Directory and Subscription filter icon and, under Switch directory, select the directory where you want to register you app. Under the directory name, there is an alphanumerical string which represents the Active Directory ID. This identifier is the first one necessary to configure the GravityZone integration.

    15271_1.png

  3. From the left-side menu, go to Azure Active Directory > App registrations > New application registration.

  4. Under Create, fill in the required fields:

    1. Name for your application.

    2. Application type: Web app / API.

    3. Sign-on URL – the URL of the GravityZone instance that you integrate with Azure.

  5. Click the Create button. A new window provides you with details about the new application. These details include Application ID, an identifier also required for GravityZone integration.

    15271_2.png

  6. Click Settings, then click Keys.

  7. In the new window, under Passwords:

    1. Enter a description as you desire.

    2. Select the duration of the key.

      Note

      After the key expires, the synchronization between the Microsoft Azure and GravityZone inventories will not be possible. In this case, you must use another key for integration.

    3. Click Save. A key value is displayed immediately. This key represents Application Secret, required to complete in Control Center the GravityZone integration with Microsoft Azure. Copy the value and keep it in a safe location.

      15271_3.png

Add Permissions for Azure Application

The Azure application requires Reader permission to be able to synchronize the Microsoft Azure and GravityZone inventories.

  1. From the left-side menu, go to Cost Management + Billing > Subscriptions.

  2. In the subscription list, click the name of the subscription you want to assign access to.

  3. Click Access control (IAM), then click Add.

  4. In the Add permissions window:

    1. Fill in the required fields with the following values:

      1. Role: Reader.

      2. Assign access to: Azure AD user, group, or application.

      3. Select: search for the name of the application that you have created.

    2. Click Save.

      15271_4.png

If you have more than one subscription in Microsoft Azure, you can add Reader permission for all of them using the same Azure application.

In this section: