Setup in Azure

This article explains how to set up a Cloudaware application in Microsoft Azure. Ensure you have the necessary permissions in the Azure portal.

Summary

To integrate Microsoft Azure with Cloudaware:

1. Create a new Azure application for Cloudaware.

2. Assign API permissions:

   • Azure Service Management

     • Delegated permissions: user_impersonation

   • Microsoft Graph

     • Application permissions: Directory.Read.All

     • Delegated permissions: Directory.Read.All

3. Add role assignments:

   • Choose the scope by assigning roles

     • Under Tenant Root Group for subscription auto-discovery

     • Under a specific subscription

   • Roles: Reader

   • Members: Application created in point 1

4. Upload a certificate from Cloudaware.

See the setup guidelines below for details.

Create Azure application for Cloudaware

1. Log in to the Azure portal. Select Microsoft Entra ID.

2. Under 'Manage', go to 'App registrations' → +New registration.

3. Set up the application as follows:
   
   Name: cloudaware-api-access
   Supported account types: Accounts in this organizational directory only (Default Directory only - Single tenant) OR Accounts in any organizational directory (Any Azure AD directory - Multitenant)
   Redirect URI (optional): Web - https://cloudaware.com/
   
   Click Register.
   

Configure API permissions

1. Select the created Azure application (in this guide, cloudaware-api-access).

2. Go to 'API permissions' → +Add a permission.

3. Select the tab 'Microsoft APIs'.
   
   For Azure Service Management:
   Select the tile 'Delegated permissions' → check the box 'user_impersonation. Access Azure Service Management as organization users (preview)'. Click Add permissions.
   
   For Microsoft Graph:
   Select the tile 'Delegated Permissions'* → Directory → check the box Directory.Read.All. Click Add permissions.
   Select the tile 'Application Permissions' → Directory → check the box Directory.Read.All. Click Add permissions.

*Note that User → User.Read (Sign in and read user profile) permission is added by default when the application is created.

Ensure that all necessary permissions are assigned as below:

4. Click Grant admin consent for <Directory Name> to populate permissions.

Microsoft takes up to 30 minutes to populate the permissions added in previous steps.

Add role assignments

Grant permissions at tenant or subscription level:

Tenant level
Assign permissions to the Tenant Root Group to allow Cloudaware to discover all subscriptions within the group automatically: Select Management Groups in Azure Portal. Select the Tenant Root Group. Go to 'Access Control (IAM)' → click +Add → Add role assignment. Grant access to the management group for Cloudaware application (in this guide, cloudaware-api-access): a. Under the tab 'Role': in 'Job function roles' select Reader → Next b. Under the tab 'Members: Assign access to: User, group, or service principal Members: click +Select members → cloudaware-api-access → Select Click Review + assign.
Subscription level
Assign permissions to the specific subscription(s) for Cloudaware to access and discover only those: Select Subscriptions in Azure Portal. Select the subscription. Go to 'Access Control (IAM)' → click +Add → Add role assignment. In 'Add role assignment' select: a. Under the tab 'Role': in 'Job function roles' select Reader → Next b. Under the tab 'Members': Assign access to: User, group, or service principal Members: click +Select members → cloudaware-api-access → Select Click Review + assign. The steps 1-5 are required for each subscription that will be integrated into Cloudaware.

Configure certificates & secrets

Certificate (recommended)

Select the application (in this guide, cloudaware-api-access).

1. Go to 'Certificates & secrets' → the tab 'Certificates' → Upload certificate. 

2. Click Select a file → choose the certificate file^*.

^*To get the certificate from Cloudaware, refer to Azure setup in Cloudaware → Add Azure Active Directory → Certificate.

Click Add.

Once the certificate is uploaded, continue the configuration.

Client secret

Select the application (in this guide, cloudaware-api-access).

1. Go to 'Certificates & secrets' → the tab 'Client secrets' → +New client secret. 

2. Set up the client secret:
   Description: ca-api-key
   EXPIRES: 730 days (24 months)
   
   Click Add.
   

3. Click Copy to clipboard to save the secret value.

Once the key is created and saved, continue the configuration.

! Next step - Azure setup in Cloudaware