Connect Microsoft Azure

Imports your Azure resource inventory: virtual machines, storage accounts and Blob containers, RBAC and PIM role assignments, network, SQL and key vaults.

For the general flow of adding a source, see Connect Data Sources.

Before you start

To configure the data source, you can use your M365 interface or use the full PowerShell script that we provide.

Prerequisites

• Active Azure subscription

• Owner or User Access Administrator role on the subscription

• Entra ID P2 for the PIM tables (role_eligibility_schedules, role_assignment_schedules) — without that licence they stay empty

Setup

Step 1 — Create an App Registration

1. Azure portal → App registrations → New registration

2. Name: HARVEN-Azure

3. Note the Application (client) ID and Directory (tenant) ID

4. Certificates & secrets → New client secret → copy the value

   • Already connected Entra ID? You can reuse its App Registration instead: skip this step and give that application the Reader role in step 2.

Step 2 — Assign Reader role on the subscription

1. Azure portal → Subscriptions → note the Subscription ID

2. Access control (IAM) → Add role assignment

3. Role: Reader

4. Member: select your HARVEN-Azure application

Fields to fill in HARVEN

Collected data

• virtual_machines — Azure virtual machines: Identification (vm_name, resource_group, location, vm_size), Status (power_state, provisioning_state, os_type), Network (private_ip_address, public_ip_address), Managed identity (identity_type, identity_principal_id)

• storage_accounts — Storage accounts: Identification (storage_account_name, sku_name, kind), Security (https_traffic_only, minimum_tls_version, allow_blob_public_access)

• blob_containers — Blob containers: Access (container_name, storage_account_name, public_access)

• role_assignments — RBAC role assignments: Principal (principal_id, principal_type), Role (role_definition_name, role_type), Scope (scope, scope_level)

• role_eligibility_schedules — PIM eligible (just-in-time) roles — requires Entra ID P2: Principal (principal_id, principal_type), Role and scope (role_definition_name, scope_level), Eligibility (status, start_datetime, end_datetime, member_type)

• role_assignment_schedules — PIM active role assignments — requires Entra ID P2: Principal (principal_id, principal_type), Role and scope (role_definition_name, scope_level), Standing (Assigned with no expiry) or just-in-time (Activated) (assignment_type, end_datetime)

• network_security_groups — Network security groups: Rule (rule_name, direction, access), Exposure (protocol, destination_port_range, source_address_prefix)

• managed_disks — Managed disks: Identification (disk_name, disk_state, managed_by), Encryption (encryption_type, disk_encryption_set_id)

• public_ip_addresses — Public IP addresses: Identification (ip_address, sku_name), Association (associated_resource_id, associated_resource_type)

• network_interfaces — Network interfaces: Association (virtual_machine_id, network_security_group_id), Network (private_ip_addresses, public_ip_ids)

• sql_servers — SQL servers: Identification (server_name, public_network_access), Security (minimal_tls_version, ad_only_auth_enabled)

• sql_databases — SQL databases: Identification (database_name, server_name, status), Encryption (tde_state)

• key_vaults — Key vaults: Identification (vault_name, sku_name), Security (enable_purge_protection, enable_rbac_authorization, public_network_access)

PowerShell script

Create the App Registration, assign the permissions and generate the secret in one command, with our PowerShell script.

Download the script

How to run it:

Windows — Right-click the file, Run with PowerShell — or in a terminal:

powershell -ExecutionPolicy Bypass -File .\setup-microsoft-connector.ps1

macOS / Linux — Install PowerShell 7 then run the script:

brew install powershell
pwsh ./setup-microsoft-connector.ps1

Arguments (optional) — Without any argument, the script is fully interactive.

• -Connector <entraid|intune|defender|mdca|azure> — Connector to configure. Omitted: the script asks in a menu.

• -AppName <name> — Name of the App Registration to create (default: HARVEN-<connector>).

• -SubscriptionId <id> — Required for azure: target subscription for the Reader role.

• -IncludeEntraIdWrite — entraid only: adds the remediation permission User.EnableDisableAccount.All.

• -Yes — Non-interactive: skips confirmations and installs missing modules automatically.

The script offers to install the missing modules automatically.

Official documentation

• Assign Azure roles

Need help? Contact [email protected].