Please follow these steps to add your Azure account and grant the necessary read-only permissions for compliance scans.
Navigate to the Onboarding page
1. Sign in to the https://app.icompaas.com portal.
2. On the left pane, click on Account settings, click Onboarding, and select Azure
Please fill in the details in the respective fields by following the steps
Create App Registration
Access your Azure Portal and navigate to App Registrations. Log in to your Azure account, & Search for App registrations
Click New registration to create a new app registration.
Choose any name for the Name field. Please take note of the name to identify the App Registration in later steps.
Select Multiple Entra ID tenants and select Allow all tenants for the Supported Account Types.
Leave the Redirect URI field empty.
Click Register to complete the app registration.
Copy the Application (client) ID and paste it into the Client ID field in the iCompaas app.
Copy the Directory (tenant) ID and paste it into the Tenant ID field in the iCompaas app.
Add Microsoft Graph Permission
Grant the Microsoft Graph Directory.Read.All and Policy.Read.All permissions for the App Registration.
Log in to the Azure portal. Navigate to App registration & select the app we created before.
Go to the API Permissions under the Manage section in the App Registration
Click Add a permission and select Microsoft Graph
Choose Application Permissions and search for Directory, then select
Directory.Read.All
Search for Policy, then select Policy.Read.All
Click the Add Permissions button.
Proceed to click Grant admin consent for the App Registration & click yes.
Create Client Secret
Generate a client secret for the App Registration and add its value to the Client Secret field
Go to the Certificates and Secrets page in the App Registration.
Go to the Client Secrets tab and click New Client Secret
Enter any description in the "Description" field.
Select an expiration period. Note that when the client secret expires, you must create a new one to continue compliance scans.
Finish creating the client secret by clicking Add
Copy the client secret Value and paste it into the Client Secret field on the iCompaas app.
Add Subscription
1. Go to your Subscription Overview page in the Azure Portal.
2. Copy the Subscription ID and paste it into the Subscription ID field on the iCompaas app.
Create IAM Role Assignment
Generate an IAM Role with the required permissions for the App Registration.
Go to the Access control (IAM) page in your Azure Subscription.
Click Add and then Add custom role.
Remove the existing JSON data and replace it with the JSON provided below. The custom role is currently saved under the name IndependentAuditorRole
NOTE: Make sure to update the subscription ID accordingly in the JSON code below
{
"properties": {
"roleName": "IndependentAuditorRole",
"description": "This role provides read-only access to all resources, including Key Vault metadata (without access to sensitive data), and web app configurations. It allows viewing but not modifying any resources and works only for Key Vaults using the 'Azure role-based access control' model.",
"assignableScopes": [
"/subscriptions/<UPADTE YOUR SUBSCRIPTION ID>"
],
"permissions": [
{
"actions": [
"*/read",
"Microsoft.Web/sites/config/list/Action",
"Microsoft.Authorization/*/read",
"Microsoft.Resources/providers/read",
"Microsoft.ResourceHealth/availabilityStatuses/read",
"Microsoft.Insights/alertRules/*/read",
"Microsoft.Resources/deployments/*/read",
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Support/*/read",
"Microsoft.KeyVault/checkNameAvailability/read",
"Microsoft.KeyVault/deletedVaults/read",
"Microsoft.KeyVault/locations/*/read",
"Microsoft.KeyVault/vaults/*/read",
"Microsoft.KeyVault/operations/read",
"Microsoft.Storage/storageAccounts/listKeys/action",
"Microsoft.operationalInsights/workspaces/*/read",
"Microsoft.Security/*/read",
"Microsoft.IoTSecurity/*/read",
"Microsoft.Management/managementGroups/read",
"Microsoft.Insights/components/*/read",
"Microsoft.Insights/metricDefinitions/read",
"Microsoft.Insights/metricNamespaces/read",
"Microsoft.Network/networkWatchers/flowLogs/read",
"Microsoft.Insights/eventtypes/values/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/read"
],
"notActions": [],
"dataActions": [
"Microsoft.KeyVault/vaults/*/read",
"Microsoft.KeyVault/vaults/secrets/readMetadata/action",
"Microsoft.KeyVault/vaults/keys/read",
"Microsoft.KeyVault/vaults/certificates/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
],
"notDataActions": []
}
]
}
}
After adding the json save the json and click on review and create.
Click Add and then Add role assignment.
In the Role tab, search for IndependentAuditorRole under Job function roles and select it.
Click the Members tab, then assign access to User, group, or service principal, and select the App Registration as the member.
Note: In the first step, we created an application; in the member section, we need to search for the application created before.
Finally, click Review + assign to grant the permissions.
Congratulations! You have completed the prerequisite steps to add your cloud account. Please click the Next button (above the steps) to finish the setup.