Connect Microsoft Azure

Imports your Azure resource inventory: virtual machines, storage accounts, and Blob containers.

For the general flow of adding a source, see Connect Data Sources.

Before you start

• Active Azure subscription

• Owner or User Access Administrator role on the subscription

Step 1 — Create an App Registration

1. Azure portal → App registrations → New registration

2. Name: HARVEN-Azure

3. Note the Application (client) ID and Directory (tenant) ID

4. Certificates & secrets → New client secret → copy the value

Step 2 — Assign Reader role on the subscription

1. Azure portal → Subscriptions → note the Subscription ID

2. Access control (IAM) → Add role assignment

3. Role: Reader

4. Member: select your HARVEN-Azure application

What to enter in HARVEN

• Tenant ID — Azure AD tenant identifier (App Registration → Directory (tenant) ID)

• Client ID — Application identifier (App Registration → Application (client) ID)

• Client Secret — Created secret (Certificates & secrets → Value)

• Subscription ID — Azure subscription identifier (Subscriptions → your subscription)

What HARVEN reads

• virtual_machines — Azure virtual machines: identification (vm_name, resource_group, location, vm_size), status (power_state, provisioning_state, os_type), network (private_ip_address, public_ip_address), managed identity (identity_type, identity_principal_id)

• storage_accounts — Storage accounts: identification (storage_account_name, sku_name, kind), security (https_traffic_only, minimum_tls_version, allow_blob_public_access)

• blob_containers — Blob containers: access (container_name, storage_account_name, public_access)

• role_assignments — RBAC role assignments: principal (principal_id, principal_type), role (role_definition_name, role_type), scope (scope, scope_level)

• network_security_groups — Network security groups: rule (rule_name, direction, access), exposure (protocol, destination_port_range, source_address_prefix)

• managed_disks — Managed disks: identification (disk_name, disk_state, managed_by), encryption (encryption_type, disk_encryption_set_id)

• public_ip_addresses — Public IP addresses: identification (ip_address, sku_name), association (associated_resource_id, associated_resource_type)

• network_interfaces — Network interfaces: association (virtual_machine_id, network_security_group_id), network (private_ip_addresses, public_ip_ids)

• sql_servers — SQL servers: identification (server_name, public_network_access), security (minimal_tls_version, ad_only_auth_enabled)

• sql_databases — SQL databases: identification (database_name, server_name, status), encryption (tde_state)

• key_vaults — Key vaults: identification (vault_name, sku_name), security (enable_purge_protection, enable_rbac_authorization, public_network_access)

Official documentation

• Assign Azure roles

Need help? Contact [email protected].