Azure Integration Setup Guide

Complete guide for integrating Azure with CyberOptix.

Prerequisites

• Azure CLI installed (Installation Guide)
• Global Administrator or Privileged Role Administrator access to Microsoft Entra ID
• Owner or User Access Administrator role on Azure subscriptions

Part 1: Create Azure Service Principal

Step 1: Retrieve Management Group ID

Get your root-level Management Group ID. Learn more about Azure Management Groups.

Alternative: Use a Subscription ID if you prefer subscription-level scope instead of management group scope.

Step 2: Create Service Principal with Required Roles

# Set your Management Group ID
MG_ID="your-management-group-id"

# Login to Azure
az login

# Create Service Principal with Reader role
SP_OUTPUT=$(az ad sp create-for-rbac \
  -n 'CyberOptix Integration' \
  --role reader \
  --scopes "/providers/Microsoft.Management/managementGroups/${MG_ID}" \
  --output json)

# Display credentials
echo $SP_OUTPUT | jq

# Extract Client ID
APP_ID=$(echo $SP_OUTPUT | jq -r '.appId')

# Add Storage Blob Data Reader role
az role assignment create \
  --assignee $APP_ID \
  --role "Storage Blob Data Reader" \
  --scope "/providers/Microsoft.Management/managementGroups/${MG_ID}"

For subscription-level access, replace the scope:

--scopes "/subscriptions/{subscription-id}"

Step 3: Save Service Principal Credentials

From the output, save these values securely:

Warning: The Client Secret is only displayed once. Store it securely.

Step 4: Verify Role Assignments

az role assignment list \
  --assignee $APP_ID \
  --scope "/providers/Microsoft.Management/managementGroups/${MG_ID}" \
  --output table

Confirm both Reader and Storage Blob Data Reader roles are listed.

Part 2: Configure Microsoft Graph API Permissions

Required for Microsoft Entra ID and Microsoft 365 log collection.

Step 1: Open App Registration

1. Navigate to Azure Portal → Microsoft Entra ID → App registrations
2. Search for and select CyberOptix Integration

Step 2: Add Microsoft Graph Permissions

1. Select API permissions → + Add a permission
2. Choose Microsoft Graph → Application permissions
3. Add these permissions:
   • AuditLog.Read.All
   • IdentityRiskEvent.Read.All
   • SecurityEvents.Read.All
4. Click Add permissions

Step 3: Grant Admin Consent

1. Click Grant admin consent for [Your Organization]
2. Click Yes to confirm

Critical: Without admin consent, log collection will not function.

Step 4: Verify Permissions

Confirm all three permissions show Granted status with a green checkmark in the Status column.

Part 3: Configure Azure DevOps Access

Required only if using the DevSecOps module.

Step 1: Add Azure DevOps API Permission

1. In App registrations → CyberOptix Integration → API permissions
2. Click + Add a permission → Azure DevOps
3. Select Delegated permissions → Check user_impersonation
4. Click Add permissions
5. Click Grant admin consent for [Your Organization]

Step 2: Add Service Principal to Azure DevOps

1. Navigate to https://dev.azure.com/{your-organization}
2. Click Organization Settings (bottom left) → Users → Add users
3. Enter the Service Principal Client ID from Part 1, Step 3
4. Set Access level to Basic
5. Click Add

Step 3: Grant Project Access

Option A - Specific Projects:

1. Go to Organization Settings → Projects
2. Select a project → Permissions tab
3. Add the Service Principal to the Readers group
4. Repeat for each project

Option B - All Projects:

1. Go to Organization Settings → Permissions
2. Add the Service Principal to the Project Collection Readers group

Part 4: Add Integration to CyberOptix

Step 1: Navigate to Integrations

1. Log in to CyberOptix
2. Navigate to Integrations → Available Integrations

Step 2: Create Azure Integration

1. Select Azure as the integration type
2. Choose Cloud as the integration mode

3. Enter the credentials from Part 1, Step 3:
   • Client ID: The appId value
   • Client Secret: The password value
   • Tenant ID: The tenant value
4. Click Submit

Step 3: Verify Integration

The integration will appear in your Active Integrations list. CyberOptix will begin discovering Azure resources within a few minutes.

Permission Summary

Azure RBAC Roles

Microsoft Graph API Permissions

Azure DevOps Permissions (Optional)

Data Collection Overview

CyberOptix performs read-only operations on the following resources:

Azure Infrastructure:

• Virtual machines, networks, subnets, NICs, public IPs
• Storage accounts, blob containers, blobs
• Load balancers, application gateways, Azure Firewalls
• Databases (SQL, CosmosDB, PostgreSQL, MySQL)
• Container instances, AKS clusters
• App Services, Front Door CDN

Microsoft Entra ID & Microsoft 365:

• User sign-in and provisioning logs
• Directory audit logs
• Identity risk detections
• Microsoft 365 Defender security alerts

Azure DevOps:

• Projects, Git repositories, branches

Additional Resources

• Azure Service Principal Documentation
• Microsoft Graph Permissions Reference
• Azure DevOps Security Best Practices