Skip to main content

Azure

Visualize and map Azure cloud resources, and monitor changes through queries and alerts.

Installation​

To install this integration, you will need to configure settings both within Azure and on JupiterOne. Before enabling in JupiterOne, ensure that you have completed the setup within your Azure.

Azure configuration​

To set up this integration, you will need to authorize access by creating a Service Principal (App Registration) in Azure and provide the credentials to JupiterOne.

The integration is triggered by an event containing the information for a specific integration instance. Users configure the integration by providing API credentials obtained through the Azure portal.

Microsoft Entra ID is authenticated and accessed through the Microsoft Graph API. Azure Resource Manager is authenticated and accessed through Resource Manager APIs.

Creating the App Registration in Azure​

The first step will be to create your App registration in Azure. From your Azure portal, navigate to Microsoft Entra ID > Manage > App registrations and continue through the following steps:

  1. Create a new App registration, using the Name JupiterOne, selecting Accounts in this organizational directory only, with no "Redirect URI".
  2. With the app created, navigate to the new app's Overview page.
  3. Copy both the Application (client) ID and the Directory (tenant) ID.
  4. Navigate to the Certificates & secrets section.
  5. Create a new client secret.
  6. Save and copy the generated secret Value (not the Secret ID).

With the App created, and the values saved, you will next need to configure the API permissions within Microsoft Entra ID.

API Permissions​

To grant permissions for reading the Microsoft Graph information:

  1. Navigate to API permissions, select Microsoft Graph > Application Permissions
  2. Grant the following permission to the application:
  • Directory.Read.All
  • Policy.Read.All
  • AuditLog.Read.All
  • Device.Read.All
  • EntitlementManagement.Read.All
  • Policy.Read.ConditionalAccess
  1. Grant admin consent for this directory for the permissions above.

IAM Roles (Azure Management Groups / Subscriptions)​

The next step within Azure is granting the JupiterOne Reader RBAC subscription role to read Azure Resource Manager information.

To grant the role:

  1. Navigate to the correct scope for your integration.
  • RECOMMENDED If configuring all subscription for a tenant: Navigate to Management Groups > the Tenant Root Group.

    If it is not possible to select the Tenant Root Group first navigate to Microsoft Entra ID > Manage > Properties and select Yes on Access management for Azure resources. See this elevating access article for more information.

note

If using this feature, in JupiterOne on your integration instance, enable the following flags:

  • Ingest Microsoft Entra ID
  • Configure Subscription Instances
    • Auto-Delete Removed Subscriptions

      If configuring a single Azure Subscription: Navigate to Subscriptions and choose the subscription from which you want to ingest resources. Please fill the Subscription ID field in your integration instance. In Azure, to get the Subscription ID navigate to Subscriptions and Copy the ID of the one to be ingested.

  1. Create the custom role "JupiterOne Reader"
  2. Navigate to Access control (IAM) > Add > Add custom role.
  3. Input JupiterOne Reader for the Name.
  4. Navigate to the JSON tab, select Edit, and input the following actions:
Actions to be added

"Microsoft.Advisor/recommendations/read", "Microsoft.ApiManagement/service/apis/read", "Microsoft.ApiManagement/service/read", "Microsoft.Authorization/classicAdministrators/read", "Microsoft.Authorization/locks/read", "Microsoft.Authorization/policyAssignments/read", "Microsoft.Authorization/policyDefinitions/read", "Microsoft.Authorization/policySetDefinitions/read", "Microsoft.Authorization/roleAssignments/read", "Microsoft.Authorization/roleDefinitions/read", "Microsoft.Automation/automationAccounts/read", "Microsoft.Batch/batchAccounts/applications/read", "Microsoft.Batch/batchAccounts/certificates/read", "Microsoft.Batch/batchAccounts/pools/read", "Microsoft.Batch/batchAccounts/read", "Microsoft.BotService/botServices/read", "Microsoft.BotService/botServices/channels/read", "Microsoft.Cache/redis/firewallRules/read", "Microsoft.Cache/redis/linkedServers/read", "Microsoft.Cache/redis/read", "Microsoft.Cdn/profiles/endpoints/read", "Microsoft.Cdn/profiles/read", "Microsoft.CognitiveServices/accounts/read", "Microsoft.Compute/disks/read", "Microsoft.Compute/galleries/images/read", "Microsoft.Compute/galleries/images/versions/read", "Microsoft.Compute/galleries/read", "Microsoft.Compute/images/read", "Microsoft.Compute/virtualMachines/extensions/read", "Microsoft.Compute/virtualMachines/read", "Microsoft.Compute/virtualMachineScaleSets/read", "Microsoft.Consumption/usageDetails/read", "Microsoft.ContainerInstance/containerGroups/read", "Microsoft.ContainerRegistry/registries/read", "Microsoft.ContainerRegistry/registries/webhooks/read", "Microsoft.ContainerService/managedClusters/maintenanceConfigurations/read", "Microsoft.ContainerService/managedClusters/read", "Microsoft.ContainerService/managedClusters/trustedAccessRoleBindings/read", "Microsoft.DBforMariaDB/servers/databases/read", "Microsoft.DBforMariaDB/servers/read", "Microsoft.DBforMySQL/flexibleServers/databases/read", "Microsoft.DBforMySQL/flexibleServers/firewallRules/read", "Microsoft.DBforMySQL/flexibleServers/read", "Microsoft.DBforMySQL/servers/databases/read", "Microsoft.DBforMySQL/servers/firewallRules/read", "Microsoft.DBforMySQL/servers/read", "Microsoft.Databricks/workspaces/read", "Microsoft.DataProtection/backupVaults/read", "Microsoft.DBforPostgreSQL/flexibleServers/databases/read", "Microsoft.DBforPostgreSQL/flexibleServers/firewallRules/read", "Microsoft.DBforPostgreSQL/flexibleServers/read", "Microsoft.DBforPostgreSQL/servers/databases/read", "Microsoft.DBforPostgreSQL/servers/firewallRules/read", "Microsoft.DBforPostgreSQL/servers/read", "Microsoft.Devices/iotHubs/Read", "Microsoft.DocumentDB/databaseAccounts/read", "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/read", "Microsoft.Easm/workspaces/read", "Microsoft.EventGrid/domains/read", "Microsoft.EventGrid/domains/topics/eventSubscriptions/read", "Microsoft.EventGrid/domains/topics/read", "Microsoft.EventGrid/topics/eventSubscriptions/read", "Microsoft.EventGrid/topics/read", "Microsoft.EventHub/clusters/read", "Microsoft.EventHub/namespaces/eventHubs/consumergroups/read", "Microsoft.EventHub/namespaces/eventhubs/read", "Microsoft.EventHub/namespaces/read", "Microsoft.Insights/ActivityLogAlerts/Read", "Microsoft.Insights/DiagnosticSettings/Read", "Microsoft.Insights/LogProfiles/Read", "Microsoft.KeyVault/managedHSMs/read", "Microsoft.KeyVault/vaults/keys/read", "Microsoft.KeyVault/vaults/read", "Microsoft.KeyVault/vaults/secrets/read", "Microsoft.MachineLearningServices/workspaces/read", "Microsoft.MachineLearningServices/workspaces/computes/read", "Microsoft.Management/managementGroups/read", "Microsoft.Network/applicationGateways/read", "Microsoft.Network/applicationSecurityGroups/read", "Microsoft.Network/azurefirewalls/read", "Microsoft.Network/bastionHosts/read", "Microsoft.Network/bgpServiceCommunities/read", "Microsoft.Network/ddosProtectionPlans/read", "Microsoft.Network/dnszones/read", "Microsoft.Network/dnszones/recordsets/read", "Microsoft.Network/expressRouteCircuits/peerings/connections/read", "Microsoft.Network/expressRouteCircuits/peerings/peerConnections/read", "Microsoft.Network/expressRouteCircuits/read", "Microsoft.Network/firewallPolicies/Read", "Microsoft.Network/firewallPolicies/ruleCollectionGroups/Read", "Microsoft.Network/frontDoors/read", "Microsoft.Network/loadBalancers/read", "Microsoft.Network/natGateways/read", "Microsoft.Network/networkInterfaces/read", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.Network/networkWatchers/flowLogs/read", "Microsoft.Network/networkWatchers/read", "Microsoft.Network/privateDnsZones/read", "Microsoft.Network/privateDnsZones/recordsets/read", "Microsoft.Network/privateEndpoints/read", "Microsoft.Network/publicIPAddresses/read", "Microsoft.Network/virtualNetworks/read", "Microsoft.PolicyInsights/policyStates/queryResults/read", "Microsoft.RecoveryServices/vaults/read", "Microsoft.Resources/subscriptions/locations/read", "Microsoft.Resources/subscriptions/read", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Security/alerts/read", "Microsoft.Security/assessments/read", "Microsoft.Security/autoProvisioningSettings/read", "Microsoft.Security/iotSecuritySolutions/read", "Microsoft.Security/pricings/read", "Microsoft.Security/securityContacts/read", "Microsoft.Security/settings/read", "Microsoft.ServiceBus/namespaces/queues/read", "Microsoft.ServiceBus/namespaces/read", "Microsoft.ServiceBus/namespaces/topics/read", "Microsoft.ServiceBus/namespaces/topics/subscriptions/read", "Microsoft.Sql/managedInstances/administrators/read", "Microsoft.Sql/managedInstances/databases/read", "Microsoft.Sql/managedInstances/read", "Microsoft.Sql/servers/administrators/read", "Microsoft.Sql/servers/databases/read", "Microsoft.Sql/servers/firewallRules/read", "Microsoft.Sql/servers/read", "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action", "Microsoft.Storage/storageAccounts/blobServices/containers/read", "Microsoft.Storage/storageAccounts/blobServices/read", "Microsoft.Storage/storageAccounts/fileServices/read", "Microsoft.Storage/storageAccounts/fileServices/shares/read", "Microsoft.Storage/storageAccounts/listKeys/action", "Microsoft.Storage/storageAccounts/queueServices/read", "Microsoft.Storage/storageAccounts/read", "Microsoft.Storage/storageAccounts/tableServices/read", "Microsoft.Storage/storageAccounts/tableServices/tables/read", "Microsoft.Subscription/policies/read", "Microsoft.Synapse/workspaces/keys/read", "Microsoft.Synapse/workspaces/read", "Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/read", "Microsoft.Synapse/workspaces/sqlPools/dataMaskingPolicies/rules/read", "Microsoft.Synapse/workspaces/sqlPools/read", "Microsoft.Web/serverfarms/Read", "Microsoft.Web/sites/config/list/action", "Microsoft.Web/sites/config/Read", "Microsoft.Web/sites/functions/read", "Microsoft.Web/sites/Read",

Data Actions to be added

"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"

  1. Click Save > Review + Create > Create.

  2. Assign Roles to the "JupiterOne" App:

    1. Navigate to Access control (IAM) > Add > Add role assignment
    2. Assign the JupiterOne Reader role to the JupiterOne member.
    3. Navigate to the Member tab. Click on + Select Members, search for the JupiterOne App, click it, and then press Select.
    4. Navigate to the Review + assign tab and click Review + assign.

Key Vaults​

Listing key vault keys and secrets (the rm-keyvault-keys and rm-keyvault-secrets steps) requires granting the JupiterOne security principal access to each key vault's data plane. Azure supports two authorization models, and which one you use depends on how each vault is configured.

note

Microsoft now recommends Azure role-based access control (RBAC), and many recently created key vaults use it by default. Check the Permission model field under Settings > Access configuration on the vault before choosing an option below.

Option A: Azure RBAC (default for new vaults)​

When a vault's Permission model is Azure role-based access control, assign the built-in Key Vault Reader role to the JupiterOne app:

  1. Navigate to the key vault in the Azure portal.
  2. Click Access control (IAM) > Add > Add role assignment.
  3. On the Role tab, search for and select Key Vault Reader.
  4. On the Members tab, click + Select members, search for the JupiterOne app registration, select it, and click Select.
  5. Navigate to the Review + assign tab and click Review + assign.

You can scope the role assignment to the resource group or subscription that contains your key vaults to cover all of them at once, instead of repeating this for each vault.

Learn more on Azure about the RBAC guide for Key Vault

Option B: Vault access policy (legacy model)​

When a vault's Permission model is Vault access policy, grant JupiterOne permissions for the vault keys and secrets (rm-keyvault-keys and rm-keyvault-secrets).

note

You are required to grant the permissions to the JupiterOne security principal for each key vault in your account. Learn more on Azure for assigning a key vault access policy

To grant the permissions:

  1. Navigate to Key Vaults and select the one you wish to ingest.
  2. Click Access policies, then + Create
  3. On the Permissions tab, under Key permissions and Secret Permissions, select the permissions.
  • Key Permissions
    • Key Management Operations
      • List
  • Secret Permissions
    • Key Management Operations
      • List
  1. On the Principal tab, assign them to the JupiterOne App.
  2. Navigate to the Review + Create tab and click Create.

That concludes the setup from within Azure. The last thing to do is initiate the integration from within JupiterOne!

Data Volume Configuration​

Control how much data is ingested from Azure to manage storage and processing.

Ingestion Windows (Time Ranges)​

FieldDescriptionDefaultOptions
Active Device WindowMaximum number of days in the past a device can be active to be eligible for ingestion. Devices with activity older than this threshold will be excluded.3030, 90, 365 days, No limit

How it affects data volume: A longer active device window increases the number of device entities ingested. Setting "No limit" ingests all devices regardless of last activity date.

Data Filtering Options​

FieldDescriptionDefault
Included Defender for cloud Alert SeveritiesSelect which Defender for Cloud alert severity levels to ingest.High, Medium
Container Registry Exclude ListComma-separated list of container registry names to exclude from repository ingestion. Registries listed here are skipped when the Container registry repositories ingestion source is enabled.(none — all registries included)

How it affects data volume: Severity filtering reduces Defender alert entities by excluding lower-severity alerts. The Container Registry Exclude List reduces repository ingestion for specific registries.

Advanced Configuration​

FieldDescriptionDefault
Advisor Recommendation Extended Properties to PromoteA list of Azure Advisor recommendation property names to surface as top-level properties on ingested recommendation entities. Each key is automatically converted to camelCase. Example: assessmentKey, score, snake_case_key.(none)

Configuration in JupiterOne​

To add the Azure integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Azure. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the Azure account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Your Azure Directory (tenant) ID of the Entra ID to target the Azure API requests.

  • The Application (client) ID created for JupiterOne and used to authenticate with Azure.

  • Enable Ingest Microsoft Entra ID to ingest Directory information.

    note

    The Ingest Microsoft Entra ID flag enables the ingestion of azure_user, azure_user_group, and azure_service_principal entities.

    This should only be enabled for one integration instance per directory.

  • Configure the Subscription Instances for your integration:

    • RECOMMENDED If configuring all subscriptions for a tenant: Select the option Configure Subscription Instances to automatically provision new JupiterOne integration instances for each Azure Subscription in this tenant that does not have a "JupiterOne" tag set to SKIP. It is recommended that you use this feature when Ingest Microsoft Entra ID selected.
    • If configuring a single Azure Subscription: Enter the Subscription ID for the subscription you wish to ingest data from. In Azure, to get the Subscription ID, navigate to Subscriptions and copy the desired Subscription ID.

    With Configure Subscription Instances enabled, the following additional options are available:

    • Auto-delete Removed Subscriptions — when enabled, automatically deletes JupiterOne integration instances for subscriptions that have been deleted or removed from Azure. Disabled by default.
    • Ingest disabled subscriptions — when enabled, ingests subscriptions that are in a disabled state. Disabled by default.
    • Auto-delete Child Integrations — when enabled, automatically deletes child integration instances when the parent integration for this directory is deleted. Enabled by default.

Once all values have been provided, click Create to finalize the integration.

Troubleshooting authentication​

If the Azure integration job does not complete, and you encounter a message such as: [validation_failure] Error occurred while validating integration configuration in your job log, check the following common configuration errors:

  • Verify the Application (client) ID and Application (client) Secret: Make sure that you've verified the proper value for client ID and client secret. The client secret has both a Value property and a Secret ID property. The Secret ID is unused: make sure you haven't accidentally used the Secret ID as the Client ID.

  • Verify that you've enabled the proper API permissions: Make sure the required API permissions (described above) are enabled for the application.

  • Verify that the API permissions have been granted as "Application" and not "Delegated": The integration requires API Permissions of type Application. Permissions of type Delegated will cause issues in your integration.

  • Verify that your permissions have been "Grant(ed) admin consent for Directory": If you have added API Permissions to the application, but have not granted Admin Consent, the permissions are not yet active.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.