Microsoft Azure | Scan Requirements

Preparation for Scanning Azure

StorageGuard collects configuration data from an Azure environment by using the Azure Java SDK running read-only Management API calls.

The following table lists the requirements for scanning Azure:

Creating a User Account for Scanning Azure

The following suggested method can be used to create an IAM user account with appropriate privileges:

Provide the Target Subscription ID:

1. Identify and provide the subscription ID of the Azure subscription you want to scan.
2. StorageGuard will collect data from all subscriptions that the app registration has permission to access, including all accessible subscriptions.

Provide Service Principal Credentials:

1. To create a Service Principal, first login to the Azure Portal.
2. Navigate to "Azure Active Directory" in the left-hand menu.
3. Under "Manage," select "App registrations," then click "New registration."
4. Enter a name for the application (e.g., "StorageGuardReader").
5. Choose an appropriate supported account type.
6. Click "Register."

Create a Client Secret:

1. After registering the application, go to "Certificates & secrets."
2. Click "New client secret."
3. Add a description and set an expiration period.
4. Click "Add" and copy the value of the client secret. You'll need this later.

Assign Reader Role to the Service Principal:

1. Navigate to your subscription or resource group.
2. Click "Access control (IAM)."
3. Click "Add," then "Add role assignment."
4. Select the "Reader" role.
5. In "Assign access to," choose "Azure AD user, group, or service principal."
6. Search for your registered application and select it.
7. Click "Save."