Onboard Azure Subscriptions

1. In the ACE Settings area, click Accounts Management.

2. On the Accounts Management page that opens, click +Onboard Accounts. The Onboard Account Wizard opens.

   

3. Click the Microsoft Azure button.

4. Select Script and click Next.

   The Azure Onboarding Wizard Access Permissions step appears.

   

5. Enable Change Policy Permissions:

   Choose which level of permissions are required for the role in Azure.

   • Clear the checkbox to fully support your Azure security policy management, security analysis and recommendations without the ability to perform policy changes

   • Select the checkbox to grant all Read functionalities to fully support your Azure security policy management, security analysis and recommendations PLUS enable advanced policy change capabilities for Azure NSGs and to enable Azure VNet flow logs scanning. This requires additional Write permissions beyond the base Read permissions.

     • Base Read permissions are described in Required Azure Permissions for Cloud Network Security,

     • Additional Write permissions are outlined in Optional Feature Permissions for Cloud Network Security.

6. Select the Azure resource type: Subscription ID, Management Group, or Tenant Root Group.

   

   Important: To run the script, the user must possess the necessary permissions for creating a service principal on the selected resource.

7. In the Resource ID field, enter the Subscription ID or Management Group Name of the Azure resource to onboard.

   Note: When Tenant Root Group is the Azure resource type, no additional information is required.

   The Cloud Shell command field is automatically populated based on the resource type and ID / Name.

8. Click Next. The Features Permissions step of the wizard opens.

   

9. Onboard VM Scanning (optional)

   The VM Scanner feature Provides agentless virtual machine security scanning for Azure VMs to detect vulnerabilities, malware, and exposed secrets across cloud workloads. For more information, see Enable Virtual Machine Security (AWS).

   

   • Select Create a custom Azure RBAC role and assign it to the service principal. For a list of permissions that are added see Permissions Required for Azure Subscriptions.

   • By default, the VM Scanner feature is set to be onboarded manually. For instructions to manually set permissions, see Enable Virtual Machine Security (Azure).

10. Onboard CD Mitigation (optional)

    The CD Mitigation feature provides threat management for Azure Container Registry (ACR) by scanning and securing your Continuous Delivery (CD) pipeline, preventing threats from reaching container-based workloads.

    

    • Select Grant CD mitigation permissions & create related resources to be automatically onboarded.

    • By default, the CD Mitigation feature is set to be onboarded manually.

11. Click Next. The Deployment step of the wizard opens.

    

12. Complete the onboarding using one of the following methods:

    Note: In the following steps, the generated onboarding script automatically assigns Azure’s built-in roles to the service principal. If your environment requires a custom role, follow the instructions in the AlgoPedia article ACE | How to Onboard Azure Using the ‘With Script’ Method When Working With a Custom Role.

    1. To open a Cloud Shell session directly from the ACE interface, click .

       Note: The Cloud Shell link is copied automatically to your clipboard.

       The Azure editor opens in a new browser tab.

       1. From the dropdown menu select Bash.

          

       2. Paste the Cloud Shell script from your clipboard and then press Enter.

          The subscription(s) is onboarded into ACE.

    2. (Alternative method) If you don't want to open a Cloud Shell session directly from the wizard, you can run bash locally using a proxy:

       1. Click Copy to copy the Cloud Shell command.

          

          Note: : The command generates an unreadable script. For an explanation of the script including an example of it in a readable version, see Inside the Azure Onboarding Script.

       2. Paste and run the script in your alternative shell to complete onboarding the subscription(s).

13. In ACE, click Close to close the onboarding wizard.

14. Open Permissions Diagnostics to confirm that the account/subscription/project meets the requirements for the ACE scan types you want to run, and use the remediation links to complete any required setup.

You can onboard Azure subscriptions, managed groups, or tenant root groups without using a script if your system does not support using scripts.

Do the following:

1. Make sure you can access the Azure console as a user with Application Administrator OR Application Developer role.

2. From the Azure CLI, create an Azure service principal based on the ACE Azure multi-tenant application. You can do this with the following command:

   az ad sp create --id 'f1764d38-8bca-497f-94ae-2ccec598107d'

   The Azure service principal is created.

   The next steps explain how to grant access permission to the service principal to a subscription or management group.

3. Navigate to the Azure console and select either the subscription or management group you want to assign role permissions.

   

4. Click Access control (IAM) from the left menu, and then click +Add.

5. From the dropdown, select Add role assignment.

   The Add role assignment page appears.

   

6. Add the role (permission) you want to assign to the service principal for working with the subscription:

   1. For Cloud Network Security, choose either:

      • Reader: Enable read access only

      • Contributor: Enable read/write access

      • Custom Role – Create a custom role if needed.

        Click for instructions to create the Custom Role

        1. In the Azure Console, go to Access Control (IAM).

        2. Click + Add and select Add Custom Role.

        3. On the Create Custom Role screen, open the JSON tab.

        4. Click Edit and add with the following JSON:

           Replace <ASSIGNABLE SCOPE> using the following formats:

           • Management group scope has the format /providers/Microsoft.Management/managementGroups/{managementGroupName}.

           • Subscription scope has the format /subscriptions/{subscriptionId}.

           Copy

           {
               "properties": {
                   "roleName": "AceCustomRole",
                   "description": "Custom role for Algosec Cloud",
                   "assignableScopes": [
                       "<ASSIGNABLE_SCOPE>"
                   ],
                   "permissions": [
                       {
                           "actions": [
                               "Microsoft.Compute/virtualMachines/read",
                               "Microsoft.Compute/virtualMachineScaleSets/read",
                               "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read",
                               "Microsoft.Compute/virtualMachineScaleSets/networkInterfaces/read",
                               "Microsoft.Insights/diagnosticSettings/read",
                               "Microsoft.Network/applicationSecurityGroups/read",
                               "Microsoft.Network/azurefirewalls/read",
                               "Microsoft.Network/connections/read",
                               "Microsoft.Network/expressRouteCircuits/read",
                               "Microsoft.Network/expressRouteCircuits/peerings/read",
                               "Microsoft.Network/firewallPolicies/read",
                               "Microsoft.Network/firewallPolicies/ruleCollectionGroups/read",
                               "Microsoft.Network/ipGroups/read",
                               "Microsoft.Network/loadBalancers/read",
                               "Microsoft.Network/localnetworkgateways/read",
                               "Microsoft.Network/locations/serviceTags/read",
                               "Microsoft.Network/networkInterfaces/read",
                               "Microsoft.Network/networkSecurityGroups/read",
                               "Microsoft.Network/networkWatchers/flowLogs/read",
                               "Microsoft.Network/networkWatchers/queryFlowLogStatus/action",
                               "Microsoft.Network/networkWatchers/read",
                               "Microsoft.Network/publicIPAddresses/read",
                               "Microsoft.Network/routeTables/read",
                               "Microsoft.Network/virtualHubs/effectiveRoutes/action",
                               "Microsoft.Network/virtualHubs/hubRouteTables/read",
                               "Microsoft.Network/virtualHubs/hubVirtualNetworkConnections/read",
                               "Microsoft.Network/virtualHubs/read",
                               "Microsoft.Network/virtualNetworkGateways/read",
                               "Microsoft.Network/virtualNetworks/read",
                               "Microsoft.Network/virtualWans/read",
                               "Microsoft.Network/vpnGateways/read",
                               "Microsoft.Network/vpnsites/read",
                               "Microsoft.Resources/subscriptions/read",
                               "Microsoft.Storage/storageAccounts/read",
                               "Microsoft.Storage/storageAccounts/listkeys/action",
                               "Microsoft.Web/hostingEnvironments/read"
                           ],
                           "notActions": [],
                           "dataActions": [],
                           "notDataActions": []
                       }
                   ]
               }
           }
           

        5. Click Save.

        6. Click Review + Create.

        7. Click Create.

   2. For Cloud App Analyzer, add:

      • Log Analytics Reader

      • AcrPull

      • Key Vault Reader

   For details, see Permissions Required for Azure Subscriptions.

7. For additional optional features:

   1. For Cloud Network Security, to allow ACE to collect NSG resource logs, grant the service principal the additional roles:

      • Network Contributor

      • Storage Account Contributor

   2. For Cloud App Analyzer:

      • Azure Kubernetes Service Cluster User Role

      • AcrPush

   3. Assign the Contributor role to enable VNet flow logs scanning for Cloud App Analyzer.

   For details, see Permissions Required for Azure Subscriptions.

8. Click Next.

   The Member tab appears.

   

9. Click Select members. From the Select members popup search for and select AlgoSec Cloud Enterprise.

   AlgoSec Cloud Enterprise will move to the Selected members section of the popup.

   

10. Click Select.

    The Service Principal is assigned to the specific subscription and role.

    

11. Click Review + assign once more to finalize the assignment and allow ACE to access the Azure subscription.

12. Manually onboard VM scanning (Optional)

13. Manually onboard CD mitigation (Optional)

    Use this method to manually onboard a CD mitigation deployment using Azure resources and the unified onboarding bundle.

    Do the following:

    1. Download the Azure resources from the URL corresponding to your region.:

       • US: https://us.app.algosec.com/prevasio/azure-application?tenant_id=${ALGOSEC_TENANT_ID}

       • EU: https://eu.app.algosec.com/prevasio/azure-application?tenant_id=${ALGOSEC_TENANT_ID}

       • ANZ: https://anz.app.algosec.com/prevasio/azure-application?tenant_id=${ALGOSEC_TENANT_ID}

       • IND: https://ind.app.algosec.com/prevasio/azure-application?tenant_id=${ALGOSEC_TENANT_ID}

       • ME: https://me.app.algosec.com/prevasio/azure-application?tenant_id=${ALGOSEC_TENANT_ID}

       • UAE: https://uae.app.algosec.com/prevasio/azure-application?tenant_id=${ALGOSEC_TENANT_ID}

       • SGP: https://sgp.app.algosec.com/prevasio/azure-application?tenant_id=${ALGOSEC_TENANT_ID}

    2. Create a resource group with the name: prevasio-${ALGOSEC_TENANT_ID:0:4}${subscription_id:0:4}-resource-group

    3. Prepare the following parameters:

       Copy

       {
           "parameters": {
               "subscription-id": {
                   "value": "$subscription_id"
               },
               "tenant-id": {
                   "value": "$azure_tenant_id"
               },
               "prevasio-hash": {
                   "value": "${ALGOSEC_TENANT_ID:0:4}${subscription_id:0:4}"
               },
               "prevasio-host": {
                   "value": "<*see values below>"
               },
               "prevasio-additionals": {
                   "value": See instructions below
               },
               "algosec-cloud-host": {
                   "value": "'$ALGOSEC_CLOUD_HOST'"
               }
       }

       * For the value of the prevasio-host, choose your region from the following:

       • US: https://us.app.algosec.com/
       • EU: https://eu.app.algosec.com/
       • ANZ: https://anz.app.algosec.com/
       • IND: https://ind.app.algosec.com/
       • ME: https://me.app.algosec.com/
       • UAE: https://uae.app.algosec.com/
       • SGP: https://sgp.app.algosec.com/

    4. To generate prevasio-additionals:

       1. Create this JSON: {"tenantId":"ALGOSEC_TENANT_ID","clientId":"ALGOSEC_CLIENT_ID","clientSecret":"ALGOSEC_CLIENT_SECRET"}
       2. Convert it to a string
       3. Convert the string to UTF-8 bytes
       4. Base64-encode it using your preferred method
       5. Example (bash):
       Copy

       tenantId="your-tenant-id"
       clientId="your-client-id"
       clientSecret="your-client-secret"
        
       json=$(printf '{"tenantId":"%s","clientId":"%s","clientSecret":"%s"}' "$tenantId" "$clientId" "$clientSecret")
       encoded=$(echo -n "$json" | base64)
        
       echo "$encoded"

    5. In the Azure Portal, go to "Deploy a custom template" in the search bar

    6. Choose "Build your own template in the editor"

    7. Use the template.json from the downloaded zip

    8. Add the parameters from step c and create the deployment

    9. Assign a custom role with the following permissions:

       Copy

       {
         "properties": {
           "roleName": "Prevasio Application Role ('${ALGOSEC_TENANT_ID:0:4}${subscription_id:0:4}')",
           "description": "Allows to create EventGrid subscriptions for ACR registries events.",
           "type": "CustomRole",
           "permissions": [
             {
               "actions": [
                 "Microsoft.EventGrid/eventSubscriptions/read",
                 "Microsoft.ContainerRegistry/registries/read",
                 "Microsoft.EventGrid/eventSubscriptions/write",
                 "Microsoft.Web/sites/functions/write"
               ],
               "notActions": [],
               "dataActions": [],
               "notDataActions": []
             }
           ],
           "assignableScopes": [
             "/subscriptions/'$subscription_id'"
           ]
         }
       }

       Note: You can also add a custom role via the Azure Console. For example

       

    10. Assign the role to: prevasio-$ALGOSEC_TENANT_ID[:5]-application.

        You can use the following commands:

        Copy

        # Get the app display name
        DISPLAY_NAME=$(az ad sp list --display-name prevasio-$ALGOSEC_TENANT_ID[:5]-application --query [].id --output tsv)
        
        # Assign the role
        az role assignment create --assignee $DISPLAY_NAME --role "$generated_role_name" --scope /subscriptions/$subscription_id

    11. Deploy the app resources using the function.zip from the sources.zip:

        The easiest way is to run the command:

        Copy

        az functionapp deployment source config-zip -g prevasio-$ALGOSEC_TENANT_ID[:5]-resource-group -n prevasio-$PREVASIO_HASH-application --src function.zip --build-remote true

        Or manually configure WEBSITE_RUN_FROM_PACKAGE pointing to a function.zip with a Blob Storage SAS URL

        Results should look like this, for example:

        

    12. Before running Azure CLI commands, set the subscription:

        Copy

        az account set --subscription "$subscription_id"

    13. If running locally, log in first:

        Copy

        az login

14. Navigate to Azure Active Directory > Properties > Tenant ID

    

15. Click on the copy icon to copy the Tenant ID associated with the subscription or management group.

16. Open Permissions Diagnostics to confirm that the account/subscription/project meets the requirements for the ACE scan types you want to run, and use the remediation links to complete any required setup.

15. Open the Onboard Azure Resources API page.

16. Configure the request:

    • Set the azure_tenant parameter to your Azure Tenant ID.

    • Set the supportChanges parameter to define the permission level:

      • true: Read/Write permissions

      • false: Read-only permissions (default)

    For more information, see Optional Feature Permissions for Cloud Network Security.

17. Run the API call to complete the onboarding process. See Onboard Azure resources.

You can use API calls to add a single Azure subscription to ACE.

Do the following:

You can leverage Terraform, the infrastructure-as-code solution, as another option for onboarding your Azure subscriptions into ACE.