Imports your Azure resource inventory: virtual machines, storage accounts, and Blob containers.
For the general flow of adding a source, see Connect Data Sources.
Before you start
Active Azure subscription
Owner or User Access Administrator role on the subscription
Step 1 — Create an App Registration
Azure portal → App registrations → New registration
Name: HARVEN-Azure
Note the Application (client) ID and Directory (tenant) ID
Certificates & secrets → New client secret → copy the value
Step 2 — Assign Reader role on the subscription
Azure portal → Subscriptions → note the Subscription ID
Access control (IAM) → Add role assignment
Role: Reader
Member: select your HARVEN-Azure application
What to enter in HARVEN
Tenant ID — Azure AD tenant identifier (App Registration → Directory (tenant) ID)
Client ID — Application identifier (App Registration → Application (client) ID)
Client Secret — Created secret (Certificates & secrets → Value)
Subscription ID — Azure subscription identifier (Subscriptions → your subscription)
What HARVEN reads
virtual_machines — Azure virtual machines: identification (vm_name, resource_group, location, vm_size), status (power_state, provisioning_state, os_type), network (private_ip_address, public_ip_address), managed identity (identity_type, identity_principal_id)
storage_accounts — Storage accounts: identification (storage_account_name, sku_name, kind), security (https_traffic_only, minimum_tls_version, allow_blob_public_access)
blob_containers — Blob containers: access (container_name, storage_account_name, public_access)
role_assignments — RBAC role assignments: principal (principal_id, principal_type), role (role_definition_name, role_type), scope (scope, scope_level)
network_security_groups — Network security groups: rule (rule_name, direction, access), exposure (protocol, destination_port_range, source_address_prefix)
managed_disks — Managed disks: identification (disk_name, disk_state, managed_by), encryption (encryption_type, disk_encryption_set_id)
public_ip_addresses — Public IP addresses: identification (ip_address, sku_name), association (associated_resource_id, associated_resource_type)
network_interfaces — Network interfaces: association (virtual_machine_id, network_security_group_id), network (private_ip_addresses, public_ip_ids)
sql_servers — SQL servers: identification (server_name, public_network_access), security (minimal_tls_version, ad_only_auth_enabled)
sql_databases — SQL databases: identification (database_name, server_name, status), encryption (tde_state)
key_vaults — Key vaults: identification (vault_name, sku_name), security (enable_purge_protection, enable_rbac_authorization, public_network_access)
Official documentation
Need help? Contact [email protected].
