You can grant the Azure app subscription access to your key vaults to enable an additional Azure security policy. ZCSPM cannot collect configuration metadata for this security policy using only the subscription reader role.

• See additional security policy with the storage account contributor role.

  Policy Title	Category
  Ensure that the expiry date is set on all Secrets in a Key Vault	Key Management

  Close

To enable the Azure app subscription access to your key vault:

1. Log in to the Azure Portal
2. In the left-pane menu, click Key vaults.
3. Click your key vault, then select Access policies.
4. Click Add Access Policy.

See image.

5. From the Key permissions drop-down menu, select List.
6. From the Secret permissions drop-down menu, select List.
7. Click Add.

See image.

You must enable the Azure app subscription access to all the key vaults.

If you have a lot of key vaults and don't want to manually give the Azure app subscription access to them, you can provision an automation account to do it for you:

• 1. Get the Application ID and Client Secret
  1. Log in to the Azure Portal
  2. In the left-pane menu, click Azure Active Directory.
  3. Select App registrations, then click New Registration.

  See image.

  

  Close

  4. Enter the Name and select the Accounts in this organizational directory only button.
  5. Click Register.
  6. Copy the Application ID to the clipboard and store it. You need to submit this information in ZCSPM.
  7. In the left-pane menu, click Certificates & secrets, then click New client secret.
  8. Enter a Description and select an expiry time, then click Add.
  9. Copy the Client secret to the clipboard and store it. You need to submit this information in ZCSPM.

  See image.

  

  Close

  You will not be able to copy the Client secret later and will have to create a new one.

  Close
• 2. Grant Admin Consent for Microsoft Graph API Permissions
  1. Log in to the Azure Portal
  2. In the left-pane menu, click Azure Active Directory.
  3. Select App registrations, then select the ZCSPM application which you want to offboard.
  4. In the left-pane menu, click API permissions.
  5. Click Add a permission, then select Microsoft Graph.
  6. Click Application permissions, then select the Azure Active Directory Graph Application.ReadWrite.all permission.
  7. Click Add permissions.
  8. Click Grant admin consent for <your azure app>.

  Close
• 3. Grant the Registered Azure App Subscription Reader Role
  1. Log in to the Azure Portal as a Subscription Owner.
  2. Go to Subscriptions, then click the subscription where you want to assign the contributor role.
  3. Click Access Control (IAM), then click Add role assignments.
  4. From the Role drop-down menu, select Contributor.
  5. From the Assign access to drop-down menu, select User, group, or service principal.
  6. From the Select drop-down menu, select the newly registered Azure application.
  7. Click Save.

  Close
• 4. Provision the Registered Azure App with the List Permissions to Key Vaults
  1. Log in to the Azure Portal as a Subscription Owner.
  2. Click on the Cloud Shell icon.
  3. Choose PowerShell, then select your storage.
  4. Download the ZCSPM data collector provisioning script by using the following commands:

  wget https://raw.githubusercontent.com/Cloudneeti/docs_cloudneeti/master/scripts/Provision-KeyVaultAccessAutomation.ps1 -O Provision-KeyVaultAccessAutomation.ps1

  wget https://raw.githubusercontent.com/Cloudneeti/docs_cloudneeti/master/scripts/AutoAssign-PermissionsToKeyvault.ps1 -O AutoAssign-PermissionsToKeyvault.ps1

  6. Run the provisioning script using the following command:

  ./Provision-KeyVaultAccessAutomation.ps1 `
             -CloudneetiRegisteredApplicationObjectId <data-collector-object-id> `
             -ApplicationId  <Contributor Application Id> `
             -SubscriptionId <Azure Subscription Id where keyvaults are present> `
             -AzureActiveDirectoryId <Azure Active Directory Id> `
             -AutomationAccountName <Automation Account Name> `
             -Location <Location>

  7. Enter the ZCSPM data collector contributor application secret.
  8. A runbook will be created in the automation account which will assign List permissions to all the key vaults.

  Close