Skip to main content

Azure

Visualize and map Azure cloud resources, and monitor changes through queries and alerts.

Installation​

To install this integration, you will need to configure settings both within Azure and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within your Azure.

Azure configuration​

To set up this integration, you will need to authorize access by creating a Service Principal (App Registration) in Azure and provide the credentials to JupiterOne.

The integration is triggered by an event containing the information for a specific integration instance. Users configure the integration by providing API credentials obtained through the Azure portal.

Microsoft Entra ID is authenticated and accessed through the Microsoft Graph API. Azure Resource Manager is authenticated and accessed through Resource Manager APIs.

Creating the App Registration in Azure​

The first step will be to create your App registration in Azure. From your Azure portal, navigate to Microsoft Entra ID > Manage > App registrations and continue through the following steps:

  1. Create a new App registration, using the Name JupiterOne, selecting Accounts in this organizational directory only, with no "Redirect URI".
  2. With the app created, navigate to the new app's Overview page.
  3. Copy both the Application (client) ID and the Directory (tenant) ID.
  4. Navigate to the Certificates & secrets section.
  5. Create a new client secret.
  6. Save and copy the generated secret Value (not the Secret ID).

With the App created, and the values saved, you will next need to configure the API permissions within Microsoft Entra ID.

API Permissions​

To grant permissions for reading the Microsoft Graph information:

  1. Navigate to API permissions, select Microsoft Graph > Application Permissions
  2. Grant the following permission to the application:
  • Directory.Read.All
  • Policy.Read.All
  • AuditLog.Read.All
  • Device.Read.All
  • EntitlementManagement.Read.All
  • Policy.Read.ConditionalAccess
  1. Grant admin consent for this directory for the permissions above.

IAM Roles (Azure Management Groups / Subscriptions)​

The next step within Azure is granting the JupiterOne Reader RBAC subscription role to read Azure Resource Manager information.

To grant the role:

  1. Navigate to the correct scope for your integration.
  • RECOMMENDED If configuring all subscription for a tenant: Navigate to Management Groups > the Tenant Root Group.

    If it is not possible to select the Tenant Root Group first navigate to Microsoft Entra ID > Manage > Properties and select Yes on Access management for Azure resources. See this elevating access article for more information.

note

If using this feature, in JupiterOne on your integration instance, enable the following flags:

  • Ingest Microsoft Entra ID
  • Configure Subscription Instances
    • Auto-Delete Removed Subscriptions

      If configuring a single Azure Subscription: Navigate to Subscriptions and choose the subscription from which you want to ingest resources. Please fill the Subscription ID field in your integration instance. In Azure, to get the Subscription ID navigate to Subscriptions and Copy the ID of the one to be ingested.

  1. Create the custom role "JupiterOne Reader"
  2. Navigate to Access control (IAM) > Add > Add custom role.
  3. Input JupiterOne Reader for the Name.
  4. Navigate to the JSON tab, select Edit, and input the following actions:
Actions to be added
"Microsoft.Advisor/recommendations/read", "Microsoft.ApiManagement/service/apis/read", "Microsoft.ApiManagement/service/read", "Microsoft.Authorization/classicAdministrators/read", "Microsoft.Authorization/locks/read", "Microsoft.Authorization/policyAssignments/read", "Microsoft.Authorization/policyDefinitions/read", "Microsoft.Authorization/policySetDefinitions/read", "Microsoft.Authorization/roleAssignments/read", "Microsoft.Authorization/roleDefinitions/read", "Microsoft.Batch/batchAccounts/applications/read", "Microsoft.Batch/batchAccounts/certificates/read", "Microsoft.Batch/batchAccounts/pools/read", "Microsoft.Batch/batchAccounts/read", "Microsoft.Cache/redis/firewallRules/read", "Microsoft.Cache/redis/linkedServers/read", "Microsoft.Cache/redis/read", "Microsoft.Cdn/profiles/endpoints/read", "Microsoft.Cdn/profiles/read", "Microsoft.Compute/disks/read", "Microsoft.Compute/galleries/images/read", "Microsoft.Compute/galleries/images/versions/read", "Microsoft.Compute/galleries/read", "Microsoft.Compute/images/read", "Microsoft.Compute/virtualMachines/extensions/read", "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachineScaleSets/read", "Microsoft.Consumption/usageDetails/read", "Microsoft.ContainerInstance/containerGroups/read", "Microsoft.ContainerRegistry/registries/read", "Microsoft.ContainerRegistry/registries/webhooks/read", "Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read", "Microsoft.ContainerService/managedClusters/read", "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read", "Microsoft.DBforMariaDB/servers/databases/read", "Microsoft.DBforMariaDB/servers/read", "Microsoft.DBforMySQL/flexibleServers/databases/read", "Microsoft.DBforMySQL/flexibleServers/firewallRules/read", "Microsoft.DBforMySQL/flexibleServers/read", "Microsoft.DBforMySQL/servers/databases/read", "Microsoft.DBforMySQL/servers/firewallRules/read", "Microsoft.DBforMySQL/servers/read", "Microsoft.DBforPostgreSQL/flexibleServers/databases/read", "Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read", "Microsoft.DBforPostgreSQL/flexibleServers/read", "Microsoft.DBforPostgreSQL/servers/databases/read", "Microsoft.DBforPostgreSQL/servers/firewallRules/read", "Microsoft.DBforPostgreSQL/servers/read", "Microsoft.DocumentDB/databaseAccounts/read", "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read", "Microsoft.EventGrid/domains/read", "Microsoft.EventGrid/domains/topics/eventSubscriptions/read", "Microsoft.EventGrid/domains/topics/read", "Microsoft.EventGrid/topics/eventSubscriptions/read", "Microsoft.EventGrid/topics/read", "Microsoft.EventHub/clusters/read", "Microsoft.EventHub/namespaces/eventHubs/consumergroups/read", "Microsoft.EventHub/namespaces/eventhubs/read", "Microsoft.EventHub/namespaces/read", "Microsoft.Insights/ActivityLogAlerts/Read", "Microsoft.Insights/DiagnosticSettings/Read", "Microsoft.Insights/LogProfiles/Read", "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/read", "Microsoft.KeyVault/vaults/secrets/read", "Microsoft.Management/managementGroups/read", "Microsoft.Network/applicationGateways/read", "Microsoft.Network/applicationSecurityGroups/read", "Microsoft.Network/azurefirewalls/read", "Microsoft.Network/bgpServiceCommunities/read", "Microsoft.Network/ddosProtectionPlans/read", "Microsoft.Network/dnszones/read", "Microsoft.Network/dnszones/recordsets/read", "Microsoft.Network/expressRouteCircuits/peerings/connections/read", "Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read", "Microsoft.Network/expressRouteCircuits/read", "Microsoft.Network/firewallPolicies/Read", "Microsoft.Network/firewallPolicies/ruleCollectionGroups/Read", "Microsoft.Network/frontDoors/read", "Microsoft.Network/loadBalancers/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkWatchers/flowLogs/read", "Microsoft.Network/networkWatchers/read", "Microsoft.Network/privateDnsZones/read", "Microsoft.Network/privateDnsZones/recordsets/read", "Microsoft.Network/privateEndpoints/read", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/virtualNetworks/read", "Microsoft.PolicyInsights/policyStates/queryResults/read", "Microsoft.Resources/subscriptions/locations/read", "Microsoft.Resources/subscriptions/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Security/alerts/read", "Microsoft.Security/assessments/read", "Microsoft.Security/autoProvisioningSettings/read", "Microsoft.Security/pricings/read", "Microsoft.Security/securityContacts/read", "Microsoft.Security/settings/read", "Microsoft.ServiceBus/namespaces/queues/read", "Microsoft.ServiceBus/namespaces/read", "Microsoft.ServiceBus/namespaces/topics/read", "Microsoft.ServiceBus/namespaces/topics/subscriptions/read", "Microsoft.Sql/servers/administrators/read", "Microsoft.Sql/servers/databases/read", "Microsoft.Sql/servers/firewallRules/read", "Microsoft.Sql/servers/read", "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action", "Microsoft.Storage/storageAccounts/blobServices/containers/read", "Microsoft.Storage/storageAccounts/blobServices/read", "Microsoft.Storage/storageAccounts/fileServices/shares/read", "Microsoft.Storage/storageAccounts/queueServices/read", "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/tableServices/read", "Microsoft.Storage/storageAccounts/tableServices/tables/read", "Microsoft.Synapse/workspaces/keys/read", "Microsoft.Synapse/workspaces/read", "Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/read", "Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/rules/read", "Microsoft.Synapse/workspaces/sqlPools/read", "Microsoft.Web/serverfarms/Read", "Microsoft.Web/sites/config/list/action", "Microsoft.Web/sites/config/Read", "Microsoft.Web/sites/Read",
Data Actions to be added
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"

  1. Click Save > Review + Create > Create.

  2. Assign Roles to the "JupiterOne" App:

    1. Navigate to Access control (IAM) > Add > Add role assignment
    2. Assign the JupiterOne Reader role to the JupiterOne member.
    3. Navigate to the Memeber tab. Click on + Select Members, search for the JupiterOne App, click it, and then press Select.
    4. Navigate to the Review + assign tab and click Review + assign.

Key Vaults​

Note: Azure allows two ways of retrieving vaults.

  1. If using Key Vault RBAC: Repeat step 5 but assing the built-in "Key Vault Reader" Role to your JupiterOne App.

  2. If using Key Vault Access Policy:

The final step in Azure will be granting JupiterOne permissions for the vault keys and secrets (rm-keyvault-keys and rm-keyvault-secrets).

note

You are required to grant the permissions to the JupiterOne security principal for each key vault in your account. Learn more on Azure for assigning a key vault access policy

To grant the permissions:

  1. Navigate to Key Vaults and select the one you wish to ingest.
  2. Click Access policies, then + Create
  3. On the Permissions tab, under Key permissions and Secret Permissions, select the permissions.
  • Key Permissions
    • Key Management Operations
      • List
  • Secret Permissions
    • Key Management Operations
      • List
  1. On the Principal tab, assign them to the JupiterOne App.
  2. Navigate to the Review + Create tab and click Create.

That concludes the setup from within Azure. The last thing to do is initiate the integration from within JupiterOne!

Configuration in JupiterOne​

To add the Azure integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Azure. Click New Instance to begin configuring your integration.

Creating a configuration requires the following:

  • The Account Name used to identify the Azure account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Your Azure Directory (tenant) ID of the Entra ID to target the Azure API requests.

  • The Application (client) ID created for JupiterOne and used to authenticate with Azure.

  • Enable Ingest Microsoft Entra ID to ingest Directory information.

    note

    The Ingest Microsoft Entra ID flag enables the ingestion of azure_user, azure_user_group, and azure_service_principal entities.

    This should only be enabled for one integration instance per directory.

  • Configure the Subscription Instances for your integration:

    • RECOMMENDED If configuring all subscriptions for a tenant: Select the option Configure Subscription Instances to automatically provision new JupiterOne integration instances for each Azure Subscription in this tenant that does not have a "JupiterOne" tag set to SKIP. It is recommended that you use this feature when Ingest Microsoft Entra ID selected.
    • If configuring a single Azure Subscription: Enter the Subscription ID for the subscription you wish to ingest data from. In Azure, to get the Subscription ID, navigate to Subscriptions and copy the desired Subscription ID.

With Configure Subscription Instances enabled, you can opt to Auto-delete Removed Subscriptions within JupiterOne and Ingest disabled subscriptons to ingest subscriptions in a disabled state.

Once all values have been provided, click Create to finalize the integration.

Troubleshooting authentication​

If the Azure integration job does not complete, and you encounter a message such as: [validation_failure] Error occurred while validating integration configuration in your job log, check the following common configuration errors:

  • Verify the Application (client) ID and Application (client) Secret: Make sure that you've verified the proper value for client ID and client secret. The client secret has both a Value property and a Secret ID property. The Secret ID is unused: make sure you haven't accidentally used the Secret ID as the Client ID.

  • Verify that you've enabled the proper API permissions: Make sure the required API permissions (described above) are enabled for the application.

  • Verify that the API permissions have been granted as "Application" and not "Delegated": The integration requires API Permissions of type Application. Permissions of type Delegated will cause issues in your integration.

  • Verify that your permissions have been "Grant(ed) admin consent for Directory": If you have added API Permissions to the application, but have not granted Admin Consent, the permissions are not yet active.