Skip to main content

Azure

Visualize and map Azure cloud resources, and monitor changes through queries and alerts.

Installation​

To install this integration, you will need to configure settings both within Azure and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within your Azure.

Azure configuration​

To set up this integration, you will need to authorize access by creating a Service Principal (App Registration) in Azure and provide the credentials to JupiterOne.

The integration is triggered by an event containing the information for a specific integration instance. Users configure the integration by providing API credentials obtained through the Azure portal.

Azure Active Directory is authenticated and accessed through the Microsoft Graph API. Azure Resource Manager is authenticated and accessed through Resource Manager APIs.

Creating the App Registration in Azure​

The first step will be to create your App registration in Azure. From your Azure portal, navigate to Azure Active Directory > App registrations and continue through the following steps:

  1. Create a new App registration, using the Name {{productName}}, selecting Accounts in this organizational directory only, with no "Redirect URI".
  2. With the app created, navigate to the new app's Overview page.
  3. Copy both the Application (client) ID and the Directory (tenant) ID.
  4. Navigate to the Certificates & secrets section.
  5. Create a new client secret.
  6. Save and copy the generated secret Value (not the Secret ID).

With the App created, and the values saved, you will next need to configure the API permissions within Azure Active Directory.

API Permissions​

To grant permissions for reading the Microsoft Graph information:

  1. Navigate to API permissions, select Microsoft Graph > Application Permissions
  2. Grant the following permission to the application:
  • Directory.Read.All
  • Policy.Read.All
  • Reports.Read.All
  1. Grant admin consent for this directory for the permissions above.

IAM Roles (Azure Management Groups / Subscriptions)​

The next step within Azure is granting the JupiterOne Reader RBAC subscription role to read Azure Resource Manager information.

To grant the role:

  1. Navigate to the correct scope for your integration.

  • RECOMMENDED If configuring all subscription for a tenant: Navigate to Management Groups > the Tenant Root Group

    note

    If it is not possible to select the Tenant Root Group first navigate to Azure Active Directory > Properties and select Yes on Access management for Azure resources. See this elevating access article for more information.

    With the Tenant Root Group selected, enable the following flags in your integration instance:

    • Ingest Active Directory
    • Configure Subscription Instances
      • Auto-Delete Removed Subscriptions

  • If configuring a single Azure Subscription: Navigate to Subscriptions and choose the subscription from which you want to ingest resources.

    note

    If configuring a single subscription please fill the Subscription ID field in your integration instance. To get the Subscription ID: Navigate to Subscriptions and Copy the ID of the one to ingest.

  1. Create the custom role "JupiterOne Reader"

  2. Navigate to Access control (IAM) > Add > Add custom role.

  3. Input JupiterOne Reader for the Name.

  4. Navigate to the JSON tab, select Edit, and input the following actions:

    Actions to be added
    "Microsoft.Advisor/recommendations/read",
    "Microsoft.ApiManagement/service/apis/read",
    "Microsoft.ApiManagement/service/read",
    "Microsoft.Authorization/classicAdministrators/read",
    "Microsoft.Authorization/locks/read",
    "Microsoft.Authorization/policyAssignments/read",
    "Microsoft.Authorization/policyDefinitions/read",
    "Microsoft.Authorization/policySetDefinitions/read",
    "Microsoft.Authorization/roleAssignments/read",
    "Microsoft.Authorization/roleDefinitions/read",
    "Microsoft.Batch/batchAccounts/applications/read",
    "Microsoft.Batch/batchAccounts/certificates/read",
    "Microsoft.Batch/batchAccounts/pools/read",
    "Microsoft.Batch/batchAccounts/read",
    "Microsoft.Cache/redis/firewallRules/read",
    "Microsoft.Cache/redis/linkedServers/read",
    "Microsoft.Cache/redis/read",
    "Microsoft.Cdn/profiles/endpoints/read",
    "Microsoft.Cdn/profiles/read",
    "Microsoft.Compute/disks/read",
    "Microsoft.Compute/galleries/images/read",
    "Microsoft.Compute/galleries/images/versions/read",
    "Microsoft.Compute/galleries/read",
    "Microsoft.Compute/images/read",
    "Microsoft.Compute/virtualMachines/extensions/read",
    "Microsoft.Compute/virtualMachines/read",
    "Microsoft.ContainerInstance/containerGroups/read",
    "Microsoft.ContainerRegistry/registries/read",
    "Microsoft.ContainerRegistry/registries/webhooks/read",
    "Microsoft.ContainerService/managedClusters/read",
    "Microsoft.DBforMariaDB/servers/databases/read",
    "Microsoft.DBforMariaDB/servers/read",
    "Microsoft.DBforMySQL/servers/databases/read",
    "Microsoft.DBforMySQL/servers/read",
    "Microsoft.DBforPostgreSQL/servers/databases/read",
    "Microsoft.DBforPostgreSQL/servers/firewallRules/read",
    "Microsoft.DBforPostgreSQL/servers/read",
    "Microsoft.DocumentDB/databaseAccounts/read",
    "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read",
    "Microsoft.EventGrid/domains/read",
    "Microsoft.EventGrid/domains/topics/eventSubscriptions/read",
    "Microsoft.EventGrid/domains/topics/read",
    "Microsoft.EventGrid/topics/eventSubscriptions/read",
    "Microsoft.EventGrid/topics/read",
    "Microsoft.Insights/ActivityLogAlerts/Read",
    "Microsoft.Insights/DiagnosticSettings/Read",
    "Microsoft.Insights/LogProfiles/Read",
    "Microsoft.KeyVault/vaults/keys/read",
    "Microsoft.KeyVault/vaults/read",
    "Microsoft.KeyVault/vaults/secrets/read",
    "Microsoft.Management/managementGroups/read",
    "Microsoft.Network/azurefirewalls/read",
    "Microsoft.Network/dnszones/read",
    "Microsoft.Network/dnszones/recordsets/read",
    "Microsoft.Network/frontDoors/read",
    "Microsoft.Network/loadBalancers/read",
    "Microsoft.Network/networkInterfaces/read",
    "Microsoft.Network/networkSecurityGroups/read",
    "Microsoft.Network/networkWatchers/flowLogs/read",
    "Microsoft.Network/networkWatchers/read",
    "Microsoft.Network/privateDnsZones/read",
    "Microsoft.Network/privateDnsZones/recordsets/read",
    "Microsoft.Network/privateEndpoints/read",
    "Microsoft.Network/publicIPAddresses/read",
    "Microsoft.Network/virtualNetworks/read",
    "Microsoft.PolicyInsights/policyStates/queryResults/read",
    "Microsoft.Resources/subscriptions/locations/read",
    "Microsoft.Resources/subscriptions/read",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Security/assessments/read",
    "Microsoft.Security/autoProvisioningSettings/read",
    "Microsoft.Security/pricings/read",
    "Microsoft.Security/securityContacts/read",
    "Microsoft.Security/settings/read",
    "Microsoft.ServiceBus/namespaces/queues/read",
    "Microsoft.ServiceBus/namespaces/read",
    "Microsoft.ServiceBus/namespaces/topics/read",
    "Microsoft.ServiceBus/namespaces/topics/subscriptions/read",
    "Microsoft.Sql/servers/administrators/read",
    "Microsoft.Sql/servers/databases/read",
    "Microsoft.Sql/servers/firewallRules/read",
    "Microsoft.Sql/servers/read",
    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
    "Microsoft.Storage/storageAccounts/blobServices/read",
    "Microsoft.Storage/storageAccounts/fileServices/shares/read",
    "Microsoft.Storage/storageAccounts/queueServices/read",
    "Microsoft.Storage/storageAccounts/read",
    "Microsoft.Storage/storageAccounts/tableServices/read",
    "Microsoft.Storage/storageAccounts/tableServices/tables/read",
    "Microsoft.Web/serverfarms/Read",
    "Microsoft.Web/sites/config/list/action",
    "Microsoft.Web/sites/config/Read",
    "Microsoft.Web/sites/Read",
    "Microsoft.KeyVault/vaults/providers/Microsoft.Insights/diagnosticSettings/Read",
    "Microsoft.Management/managementGroups/subscriptions/read"

  5. Click Save > Review + Create > Create.

  6. Assign Roles to the "JupiterOne" App:

  • Navigate to Access control (IAM) > Add > Add role assignment
  • Assign the JupiterOne Reader role to the JupiterOne member.
  • Navigate to the Memeber tab. Click on+ Select Members, search for the JupiterOne App, click it, and then press Select.
  • Navigate to the Review + assign tab and click Review + assign**.

Key Vault Access Policy​

The final step in Azure will be granting JupiterOne permissions for the vault keys and secrets (rm-keyvault-keys and rm-keyvault-secrets).

note

You are required to grant the permissions to the JupiterOne security principal for each key vault in your account. Learn more on Azure for assigning a key vault access policy

To grant the permissions:

  1. Navigate to Key Vaults and select the one you wish to ingest.
  2. Click Access policies, then + Create
  3. On the Permissions tab, under Key permissions and Secret Permissions, select the permissions.
  • Key Permissions
    • Key Management Operations
      • List
  • Secret Permissions
    • Key Management Operations
      • List
  1. On the Principal tab, assign them to the JupiterOne App.
  2. Navigate to the Review + Create tab and click Create.

That concludes the setup from within Azure. The last thing to do is initiate the integration from within JupiterOne!

Finalize in JupiterOne​

To add the Azure integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Azure. Click New Instance to begin configuring your integration.

Creating a configuration requires the following:

  • The Account Name used to identify the Azure account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Your Azure Directory (tenant) ID of the Active Directory to target the Azure API requests.

  • The Application (client) ID created for JupiterOne and used to authenticate with Azure.

  • Select Ingest Active Directory to ingest Directory information.

    note

    The Ingest Active Directory flag enables the ingestion of azure_user, azure_user_group, and azure_service_principal entities.

    This should only be enabled for one integration instance per directory.

  • Configure the corresponding scope for your integration:

    • RECOMMENDED If configuring all subscriptions for a tenant: Select the option Configure Subscription Instances to automatically provision new JupiterOne integration instances for each Azure Subscription in this tenant that does not have a "JupiterOne" tag set to SKIP. It is recommended that you use this feature when Ingest Active Directory selected.
    • If configuring a single Azure Subscription: Enter the Subscription ID for the subscription you wish to ingest data from.

Click Create once all values are provided to finalize the integration.

Troubleshooting authentication​

If the Azure integration job does not complete, and you encounter a message such as: [validation_failure] Error occurred while validating integration configuration in your job log, check the following common configuration errors:

  • Verify the Application (client) ID and Application (client) Secret: Make sure that you've verified the proper value for client ID and client secret. The client secret has both a Value property and a Secret ID property. The Secret ID is unused: make sure you haven't accidentally used the Secret ID as the Client ID.

  • Verify that you've enabled the proper API permissions: Make sure the required API permissions (described above) are enabled for the application.

  • Verify that the API permissions have been granted as "Application" and not "Delegated": The integration requires API Permissions of type Application. Permissions of type Delegated will cause issues in your integration.

  • Verify that your permissions have been "Grant(ed) admin consent for Directory": If you have added API Permissions to the application, but have not granted Admin Consent, the permissions are not yet active.