Deploying the Azure Adapter

1. Log in to the Azure Portal with an administrator account.

2. In the App registrations click on New registration.

3. Fill in the details:

   a. Enter the name Axonius App for the application.
   b. Select Single tenant as the supported account type.

4. Click Register to create the application.

   

5. After you have created the app, the Application (client) ID and Directory (tenant) ID values are displayed. Copy these values to use when you configure the adapter in Axonius.

   

6. Assign Directory Permissions (Entra ID)

   a. Go to Microsoft Entra ID and select Enterprise applications.
   b. Select the application you created.
   c. Navigate to Roles and administrators.
   d. Assign the Directory Reader role to the application.

1. Create a Client Secret

   a. Open the application you registered.
   b. Within the app registration, navigate to Certificates & secrets, then go to Client secrets and select New client secret.
   c. Choose an expiration period for the client secret.

   

   d. Click Add and copy the Client Secret Value to use when you configure the adapter in Axonius. Note that you cannot view it again once you leave the page.

2. Assign Required Roles

   Assign the Reader role at either the Management Group level (recommended) or the Subscription level. Management Group is recommended to prevent blank spots.

   Option 1: Management Group Level (Recommended)

   a. Navigate to Management Groups.
   b. Select the Management Group that contains the subscriptions to be scanned.
   c. Open Access control (IAM).
   d. Click Add, then select Add role assignment.

   

   e. Assign the Reader role to the Enterprise Application.

   Option 2: Subscription Level

   a. Navigate to Subscriptions.
   b. Select the subscription to be scanned.
   c. Open Access control (IAM).
   d. Click Add, then select Add role assignment.

   

   e. Assign the Reader role to the Enterprise Application.

1. Upload a Certificate

   a. Open the application you registered.
   b. In the app registration, navigate to Certificates & secrets, then go to Certificates and select Upload certificate.
   c. Upload your public certificate file (.cer, .pem, or .crt).

   

   d. The certificate’s thumbprint will be used as the authentication key for the adapter.

2. Assign Required Roles

   Assign the Reader role at either the Management Group level (recommended) or the Subscription level, depending on your required scope.

   Option 1: Management Group Level (Recommended)

   b. Navigate to Management Groups.
   c. Select the Management Group that contains the subscriptions to be scanned.
   d. Open Access control (IAM).
   e. Click Add, then select Add role assignment.

   

   f. Assign the Reader role to the Enterprise Application.

   Option 2: Subscription Level

   a. Navigate to Subscriptions.
   b. Select the subscription to be scanned.
   c. Open Access control (IAM).
   d. Click Add, then select Add role assignment.

   

   e. Assign the Reader role to the Enterprise Application.

To fetch certificates or keys from Key Vaults (optional):

1. In the Azure Portal search and select Key Vaults.

2. Select the Key Vault you want Axonius to access.

3. In the Key Vault menu, go to Access control (IAM), click Add, and select Add role assignment.

   To assign role:
   a. Certificates: Select the Key Vault Certificates Reader role and assign it to the Enterprise Application created for Axonius.
   b. Keys: Select the Key Vault Crypto Officer role and assign it to the Enterprise Application created for Axonius.

4. Click Review + assign to finalize each role assignment.

• Azure Management Group IDs - Enter the Azure management group IDs associated with the subscriptions you want to fetch data from. The adapter will fetch data only from the subscriptions with the specified management groups.
• Cloud Environment – Select Microsoft Azure cloud environment type.
• Azure Stack Hub Management URL and Azure Stack Hub Resource String - Specify the hostname or IP address of the Microsoft Azure Stack Hub server (a Microsoft Azure on-premises server) and the URL for the Azure Stack Hub Resource String.
  • If supplied, Axonius will authenticate to the Microsoft Azure cloud server, and will fetch asset data from the Microsoft Azure Stack Hub server. Axonius will not fetch any asset data from Microsoft Azure cloud server.
  • If not supplied, Axonius will authenticate to the Microsoft Azure cloud server, and will fetch asset data from the Microsoft Azure cloud server. Axonius will not fetch any asset data from Microsoft Azure Stack Hub server.
• Azure Stack Hub Proxy Settings (default: Do not use proxy) - Select one of the following proxy options:
  • Do not use proxy - Axonius will not use a proxy to authenticate to the Microsoft Azure cloud server and will not use a proxy to fetch asset data from the Microsoft Azure Stack Hub server.
  • Proxy authentication only - Axonius will only use the proxy specified in the HTTPS Proxy field to authenticate to the Microsoft Azure cloud server.
  • Proxy Azure Stack Hub only - Axonius will only use the proxy specified in the HTTPS Proxy field to fetch asset data from the Microsoft Azure Stack Hub server.
  • Proxy all - Axonius will use the proxy specified in the HTTPS Proxy field to authenticate to the Microsoft Azure cloud server and also to fetch asset data from the Microsoft Azure Stack Hub server.
• Account Tag - Tag for the Azure Cloud instance ("nickname").
  • If supplied, Axonius will tag all devices fetched from this adapter connection.
  • If not supplied, Axonius will not tag any of the devices fetched from this adapter connection.
• Verify SSL – Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.
• HTTPS Proxy – A proxy to use when connecting to the selected Azure cloud environment.
• HTTPS Proxy User Name and Password – The user name and password to use when connecting to the selected Microsoft Azure cloud environment via the value supplied in HTTPS Proxy.
• Enable Client Side Certificate – Use certificate-based authentication instead of a client secret.
  • Client Private Key File – Upload the private key (.pem) used for certificate-based authentication.
  • Client Certificate File (.pem) – Upload the public certificate file (.pem) used for certificate-based authentication.
• Notes – Add a note of up to 250 characters for this adapter connection.
• Select Gateway – Select the Axonius Gateway to use when connecting adapters whose sources are only accessible by an internal network. To use this option, you need to set up an Axonius Gateway.