Configure Azure Cloud Security Posture Management (CSPM)

Estimated Time to Complete: 10 minutes

Contact us to learn more about adding Managed Detection & Response (MDR) services to your Azure endpoints

To enable the ActZero team to monitor your Azure environment, you need to complete a few steps to configure a connection from your cloud environment to ActZero. Use the instructions below to set up an Azure App Registration with the necessary read-only permissions.

Overview

There are two methods to prepare the Azure subscription to be scanned for CSPM:

1. Manual Method
2. PowerShell Script

Whichever method you choose, the user must be a Global Administrator, or at least have sufficient permissions to create an App Registration, Secret and assign API & RBAC permissions to the application and Subscription.

Once completed, you will need to encrypt the copied values into Keybase and send them via email.

Manual Method

You can manually create the App Registration, a corresponding Secret value, and add the API & RBAC permissions through the Azure Portal. To do so, perform the following steps:

Create an App Registration

1. Sign into the Azure portal.
2. Locate and open App Registrations.
3. In the App Registrations page, click on New Registration.

4. Create the App Registration:

   1. Give the App a name (i.e. cspm-scan).
   2. Select Accounts in this organization directory only.
   3. Leave URI(optional) field unchanged.
   4. Click Register.

5. Copy the following information from the App Registration you just created:

   1. Application (client) ID.
   2. Directory (tenant) ID.

Create App Registration Secret

1. For the Application you just created, click on Certificates and Secrets on the left-hand side.
2. Click on New Client Secret.
3. Enter a description for the Client Secret (i.e. cspm-scan-secret).
4. Selecte the maximum expiration time: 730 Days.
5. Click Add.
6. From the resulting Secret copy the contents of the Value column.

Add Permissions

Add the following Microsoft Graph permissions to the App Registration:

• Directory.Read.All
• Policy.Read.All

To add the permissions, perform the following:

1. For the Application you just created, click on API Permissions on the left-hand side.
2. Click on Add a Permission.
3. Click on Microsoft Graph.
4. Click on Application Permissions.
5. Perform a search for Directory and select Directory.Read.All.
6. Perform a search for Policy and select Policy.Read.All.
7. Click on Add Permissions at the bottom of the page.

Add Consent

You should now see the permissions you added, however it may be necessary to give Admin Consent.

To do so, perform the following steps:

1. Click on Grant admin consent for <Directory Name>.
2. Select Yes on the pop-up.
3. You should now see a green checkmark under the Status column.

Add Role Assignments

You will need to assign RBAC roles in the subscription. To do so:

1. Open the Subscriptions page (you can use the search bar at the top to find it).
2. Click on the corresponding Subscription to open its properties.
3. Open Access Control(IAM) on the left-hand side.
   
4. Click on +Add and select Add role assignment from the dropdown.

Add Security Reader Role

1. Search for Security Reader role and select it from the list.
2. Click Next.
3. Under the Members tab, ensure the radio button has User, group or service principal selected.

   

4. Click on Select Members.
5. Search for the registered application name (i.e. cspm-scan) on the right-hand side.
6. Select the Registered App.
7. Click on the Select button at the bottom.
8. You should now see the cspm-scan application listed under Members.
9. Click on Next.
10. Review the changes and click on Review + assign.

Add Reader Role

To add the Reader role, repeat the same steps performed for adding the Security Reader role. To find the role, perform a search for Reader under the Job function roles.

Encrypt the values

Encrypt the cspm-scan-secret,Application ID, and Directory ID values that you copied and send them to ActZero. Follow the steps listed here

PowerShell Script

The PowerShell script will perform the following tasks:

• Install the AzureAD.Standard and Microsoft.Graph packages as needed.
• Check the tenants present. If multiple tenants are found, you can select which tenant you would like to set up the registration for.
• Create an App Registration and Secret Value under the subscription for the Azure tenant
• Add the necessary API permissions and RBAC roles.

To run the PowerShell script, perform the following steps:

1. Download the azureappregistration.ps1 script from here.
2. Log into your Azure portal.
3. Open the Azure Cloud Shell, and select PowerShell.
   1. If prompted, create an Azure file share.
4. Upload the azureappregistration.ps1 script to Azure PowerShell.
5. Run the script by typing ./azureappregistration.ps1
6. The script requires authentication through a web browser, necessitating a device login at https://microsoft.com/devicelogin. Enter the code provided by the script to authenticate the Microsoft Graph Command Line Tools.
7. The script will output the values needed by ActZero to scan the Azure Subscription. Copy these values.
8. Encrypt the values in Keybase (See instructions below)

Encrypt Values using Keybase

To securely encrypt the values (Tenand ID, Client ID and Client Secret), you will use Keybase. For this, you DO NOT need to create a Keybase account.

Follow these steps:

1. Open Keybase
2. For Recipient use: actzerocre
3. For Message to Encrypt, paste the values (copied from the previous steps) in the following format:

   Client Secret: <cspm-scan-secret Value>
   Client ID: <Application ID>
   Tenant ID: <Directory ID>
   

4. Click on the Encrypt Button
5. Copy the encrypted contents of the message, and send them via email.
6. Erase the copies of the sensitive information in your local environment.