Microsoft Azure | Scan Requirements

[ Applies to ] StorageGuard 9.x and later   /   Microsoft Azure subscriptions   /   Microsoft Entra ID

StorageGuard collects configuration data from a Microsoft Azure environment by using the Azure Java SDK to run read-only management API calls. It authenticates as a service principal (an app registration) with the Reader role. This article describes the requirements and how to create the service principal.

Requirements

Create the service principal

The following procedures are a suggested way to create a service principal with read-only access. Do them in order, in the Azure portal.

1. Register an application

1. Sign in to the Azure portal.
2. Go to Microsoft Entra ID (formerly Azure Active Directory).
3. Under Manage, select App registrations, and then click New registration.
4. Enter a name for the application, for example StorageGuardReader.
5. Choose the supported account type that fits your organization.
6. Click Register.
7. On the application's Overview page, copy the Application (client) ID and Directory (tenant) ID. These are the Client ID and Tenant ID StorageGuard needs.

2. Create a client secret

1. In the application, go to Certificates & secrets.
2. Click New client secret.
3. Enter a description, and set an expiration period.
4. Click Add, and copy the secret Value.

3. Assign the Reader role

1. Go to the subscription or resource group you want to scan.
2. Click Access control (IAM).
3. Click Add > Add role assignment.
4. Select the Reader role.
5. In Assign access to, choose User, group, or service principal.
6. Search for the application you registered, and select it.
7. Click Save.