You can onboard your Microsoft Azure cloud account onto ZCSPM. Once onboarded, ZCSPM will be able to provide you with your account's security posture. ZCSPM will run your Azure cloud account deployment against all the security policies we offer. To view the security policies, see Azure Security Policies. To onboard an Azure account with ZCSPM:

• 1. Ensure that the prerequisites are met.
  • You need to be a ZCSPM License Admin to onboard an Azure cloud account onto ZCSPM.
  • You need to be an Azure Global AD Administrator and a Subscription Owner to register the ZCSPM app and grant access permissions to ZCSPM.

  Close
• 2. Create a new Azure app registration.

  You can create a new Azure app registration either manually or by running an automation script on the Cloud Shell. To register a new Azure app manually:

  • a. Get the Application ID and Client Secret.
    1. Log in to the Azure Portal
    2. In the left-pane menu, click Azure Active Directory.
    3. Select App registrations, then click New Registration.

    See image.

    

    Close

    4. Enter the Name and select the Accounts in this organizational directory only button.
    5. Click Register.
    6. Copy the Application ID to the clipboard and store it. You need to submit this information in ZCSPM.
    7. In the left-pane menu, click Certificates & secrets, then click New client secret.
    8. Enter a Description and select an expiry time, then click Add.
    9. Copy the Client secret Value to the clipboard and store it. You need to submit this information at ZCSPM.

    See image.

    

    Close

    You will not be able to copy the Client secret later and will have to create a new one.

    Close
  • b. Grant the registered Azure App subscription reader role.
    1. Log in to the Azure Portal as a Subscription Owner.
    2. Go to Subscriptions, then click the subscription where you want to assign the reader role.
    3. Click Access Control (IAM), then click Add role assignments.

    See image.

    

    Close

    4. From the Role drop-down menu, select Reader.
    5. From the Assign access to drop-down menu, select User, group, or service principal.
    6. From the Select drop-down menu, select the newly registered Azure application.
    7. Click Save.

    See image.

    

    Close

    Close
  • c. Get the Azure Tenant ID and Domain name.
    1. Log in to the Azure Portal
    2. In the left-pane menu, click Azure Active Directory.
    3. Copy the Tenant ID and the Primary Domain to the clipboard and store it. You need to submit this information at ZCSPM.

    See image.

    

    Close

    Close

  Alternatively, you can register a new Azure app by running a script on the Cloud Shell. The script will register a new Azure application and grant the application the subscription reader role.

  • Run the registration script on the cloud shell.
    1. Ensure you have PowerShell version v5 or higher. Verify your PowerShell version using the following command:

    $PSVersionTable.PSVersion

    2. Ensure there are no restrictions on PowerShell to run the agent installation script. Remove restrictions on PowerShell using the following command:

    Set-ExecutionPolicy `
    -Scope Process `
    -ExecutionPolicy Bypass

    3. Download the PowerShell script files from ZCSPM Github.
    4. Install Azure modules by using the following command:

    Install-Module `
    -Name AzureAD `
    -MinimumVersion 2.0.0.131

    5. Open PowerShell as an administrator.
    6. Navigate to the directory where the script was downloaded.
    7. Run the following command to create a new Azure app registration:

    .\Create-ServicePrincipal-AzureOnboarding.ps1 `
    -azureActiveDirectoryId <active_directory_id> `
    -servicePrincipalName <data_collector_name> `
    -expirationPeriod 1year

    9. Enter the Global AD Administrator credentials.
    10. Copy the following information and store them:
        • Tenant Id
        • Domain Name
        • Application Id
        • Password Key

    In case you do not want to provide Microsoft Graph permissions, use the following command instead:

    .\Create-ServicePrincipal-AzureOnboarding.ps1 `
    -azureActiveDirectoryId <active_directory_id> `
    -servicePrincipalName <data_collector_name> `
    -expirationPeriod 1year
    -disableADPolicies

    Close

  Close
• 3. Add your Azure subscription on ZCSPM.
  1. Log in into ZCSPM as a License Admin.
  2. Click Activate License.
  3. Select Azure, then click Continue.
  4. Select New Azure AD Tenant.
  5. Enter the following information:
     • Cloud Account Name
     • Domain Name
     • Azure Directory Id
     • Azure Application Id
     • Azure Application Secret
  6. Click Get Subscription.

  Close

In addition to onboarding your Azure account on to ZCSPM, you can have optional configurations and certain agents on your Azure cloud account to collect additional metadata:

• Grant Admin Consent for Microsoft Graph API Permissions
• Grant Access to Additional Roles in Microsoft Azure
• Grant Access to Key Vaults
• Enable Advanced Security Configurations
• Enable Azure Security Center (ASC) audit
• Configure OS Baselines for Microsoft Azure
• Configure ZCSPM Agent for the Azure Kubernetes Service (AKS)

If you'd like to offboard your Azure account, see Offboarding a Microsoft Azure Account.