Azure Integrations - User Guide

In this article, you will understand step by step how to easily integrate Scytale with Azure integrations

Learn how to connect multiple Azure services seamlessly using the same credentials, simplifying integration and ensuring access for most Microsoft integrations. We will guide you through setting up permissions for Azure services integrated with Scytale.

Permissions for Azure Integrations

The following read-only actions must be assigned via a custom role to allow Scytale to collect evidence from Azure services:

"permissions": [
            {
                "actions": [
                    "Microsoft.Network/*/read",
                    "Microsoft.ClassicNetwork/*/Read",
                    "Microsoft.Compute/*/Read",
                    "Microsoft.Insights/*/Read",
                    "Microsoft.Storage/*/read",
                    "Microsoft.Sql/*/read",
                    "Microsoft.Resources/*/read",
                    "Microsoft.KeyVault/*/read",
                    "Microsoft.DocumentDB/*/read",
                    "Microsoft.DBforPostgreSQL/*/read"
                ],
                "notActions": [],
                "dataActions": [
                    "Microsoft.KeyVault/*/read"
                ],
                "notDataActions": []
            }
        ]

• In the overview tab of the application, refer to the information under "Essentials", copy (you'll use it for Scytale connection):
  • Application (Client) ID.
  • Directory (tenant) ID.

Step 3: How to Create a Custom Role in Azure

• Go to subscriptions. 
• Copy the relevant subscription ID (you'll need to paste it into the scytale integration connection).

• Click on the relevant subscription. 
• Navigate in the subscription menu to 'Access control (IAM)'.
• Select +Add and select the 'Add custom role' option. 

• Under the basics tab, choose a name for the 'Custom role name'.
• Click on 'Next'.

• Go to the JSON tab and click on 'Edit'.
• Paste the following JSON snippet in the "permissions" key:
  

  "permissions": [
              {
                  "actions": [
                      "Microsoft.Network/*/read",
                      "Microsoft.ClassicNetwork/*/Read",
                      "Microsoft.Compute/*/Read",
                      "Microsoft.Insights/*/Read",
                      "Microsoft.Storage/*/read",
                      "Microsoft.Sql/*/read",
                      "Microsoft.Resources/*/read",
                      "Microsoft.KeyVault/*/read",
                      "Microsoft.DocumentDB/*/read",
                      "Microsoft.DBforPostgreSQL/*/read"
                  ],
                  "notActions": [],
                  "dataActions": [
                      "Microsoft.KeyVault/*/read"
                  ],
                  "notDataActions": []
              }
          ]

• Click on 'Save',  then 'Review + create', and then 'Create'.

Step 4: How to Assign the Role to the Application

• Return again in the subscription menu to 'Access control (IAM)'.
• Select +Add and select the 'Add role assignment' option. 

• In the role tab, search for the custom role you created in step 3.
• Click on the role and then select 'Next'. 

• In the members tab, on the Members section, click on '+select members'. 
• Search the application name you created in step 1 and click on it. 
• Click on 'Select'. 
• Click on 'Review + assign'.