Skip to main content

How to configure the Azure integration for evidence generation

Meg Colborne
Updated

Gathering logs, security configurations, and access controls across Azure services can be tedious and error-prone. The Complyance Azure integration automates this by pulling the latest compliance evidence, ensuring it stays up to date before expiration.

This integration covers additional Microsoft services such as Defender and Intune. Please contact your implementation lead for the permissions for any additional services.

Register Complyance app

  1. Go to the App registrations page in the Azure Portal: https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

  2. Click New registration.

  3. Fill the form:

    • Name: Complyance
    • Supported account types: Accounts in this organizational directory only
    • Redirect URL (optional): Leave empty

    Click Register.

  4. You will be redirected to the Overview page of the newly created app. Please save the Application (client) ID, as it will be needed later.

Configure Permissions

Each Azure integration check requires configuring permissions to allow the app registered in Step 1 to pull necessary data. There are two places where permissions can be configured:

  1. API permissions at the App registration level
  2. Access control (IAM) at the Azure subscription level

If you are unsure which of these is required, please message your implementation lead!

 

1. API Permissions on the App registration level

  1. Go to App registrations page in Azure portal: https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/RegisteredApps In All applications tab search for the app created in step 1. Register Complyance app and open it’s page

    ann_01_select_app.png

  2. Go to the API permissions tab.

    ann_02_go_to_api_permissions.png

  3. Click on the Add a permission button.

    ann_03_click_add_permission.png

  4. Select Microsoft Graph.

    ann_04_click_microsoft_graph.png

  5. Select Application permissions, search for the required permissions, tick the checkbox for each of them, and click Add permissions button.

    ann_05_find_permission.png

  6. Click on the Grant admin consent for {tenant_name} button.

    ann_06_click_grant_admin_consent.png

  7. Confirm the admin consent modal.

    ann_07_click_yes.png

  8. Confirm, that the permission’s status became Granted for {tenant_name}.

    ann_08_confirm_access_granted.png

     

2. Access control (IAM) on the Azure subscription level

If this is the first time configuring permissions at the Azure subscription level, please follow the Create custom role and Assign custom role to app instructions. 

If you have configured these permissions before, please follow the Updating custom role permissions instructions below.

Create custom role

  1. Go to your Azure Subscription and select Access control (IAM). Click Add → Add custom role.

  2. In the Basics tab, fill in Custom role name (e.g. Complyance Integration) and click Next.

  3. In the Permissions tab, click Add permissions and add the permissions needed for the integration check to fetch the required data (should be communicated by the CE team). Click Review + create.

  4. In the Review + create tab, click Create.

Assign custom role to app

  1. Go to your Azure Subscription and select Access control (IAM). Click Add → Add role assignment.

  2. In the Role tab, select the role created in the Create custom role step and click Next.

  3. In the Members tab, click Select members and select the app created in the Register Complyance app step. Click Review + assign.

  4. In the Review + assign tab, click Review + assign.

Update custom role permissions

  1. Go to your Azure Subscription and select Access control (IAM). Select Roles tab, search for the Complyance Integration role created in the previous step and click Edit in it’s dropdown menu.01_find_iam_role.png
  2. Go to Permissions tab.02_select_permissions_tab.png
  3. Click Add permissions button, search for the required permissions, tick their checkboxes and click Add.03_find_and_add_permissions.png
  4. Click Review + update button.04_click_review_and_update.png
  5. Confirm that all the required permissions are in the list and click Update.05_update.png

 

Create app client secret

  1. On the Complyance app registration page, click Certificates & secrets.

  2. Click New client secret.

  3. Fill the form:

    • Description: Complyance Client Secret
    • Expires: Choose an expiry period that balances your security requirements with how often it will need to be updated in the Complyance platform

    Click Add.

  4. Save the secret before leaving the page, as it will not be visible again.

Securely provide the following credentials to the Complyance team

  • Tenant ID - Microsoft Entra ID, can be found in Tenant Properties
  • Subscription ID - ID of the subscription containing the resources to be checked, available on the Subscriptions page in the Azure portal
  • Client ID - App registration ID from the Register Complyance app step

  • Client secret - App registration client secret from the Create app client secret step

     

 

Related articles