Azure Cloud integration

Jamie Kandola
Jamie Kandola
  • Updated

About

The Azure integration connects ControlMap to your client's Azure subscription and checks it against a set of cloud security checks called Azure Baseline Controls. Results appear in Monitor › Compliance Checks, so you can show evidence of how the Azure environment is configured without collecting it by hand.

Once connected, ControlMap brings in:

  • Azure directory users, which appear as user accounts together with their multi-factor authentication (MFA) registration details.
  • Azure resources, which appear as assets. These include virtual machines, disks, storage accounts, SQL databases, network security groups and load balancers.

Each Azure Baseline Controls check has its own remediation article in the Cloud Scan remediation steps section of the Help Center. If a check fails, open the article for that check to see how to fix it.

Azure scans your Azure subscription. To collect data from Microsoft sign-in products such as Azure Active Directory, Microsoft Intune and Microsoft Office 365, use the Microsoft integration instead.

Before you start

Have these ready from your client's Azure environment:

  • Setting up integrations from the client portal is part of the Pro plan. For details, see the Free, Essentials and Pro plans article.
  • The Subscription Id of the subscription to scan.
  • The Tenant Id.
  • The App Id and Client Secret of an app ControlMap can sign in with.

Connect Azure

  1. Go to Monitor › Integrations and select Add Integration.
  2. Search for Azure and select the Azure card. The Azure DevOps card sits next to it; it is a separate integration.

The Add Integration window searched for Azure, showing the Azure and Azure DevOps cards

  1. On the Connection step, enter a Connection Name. Azure starts with this field blank, and all of the fields on this step are required.
  2. Enter the Subscription Id, Tenant Id, App Id and Client Secret.

The Add Azure setup page on the Connection step, with the five fields and a help panel on the right

  1. Select Next: Checks. ControlMap signs in to Azure with the App Id and Client Secret and checks that it can see the subscription. If the details are wrong, the connection is not created.
  2. Complete the remaining steps as described in the Connect an integration article.

The help panel beside the form has a link, Read this article on Support Portal, and a short article about the Azure connector.

What you'll see after connecting

When you finish, the new connection's page opens. ControlMap fills in the data after the first scan:

  • Compliance Checks: the Azure Baseline Controls checks show No Data until the first scan finishes. Each check then shows its result.
  • Assets: your Azure resources.
  • User Accounts: your Azure directory users, with their MFA registration details.

The connection's page shows its status (Checking connection..., Connected, Disconnected or Connection status unavailable) and whether it is Running or Not Running. To scan straight away, select Run Once.

Disconnect or change settings

Go to Monitor › Integrations and select the Azure card to open it. The Connection and Schedule tabs work as described in the Connect an integration article. Azure also has an Exclusions tab, after Schedule, where you add rules to leave out accounts:

  • Email addresses and group names.
  • Email patterns and group patterns.
  • Options for inactive or disabled accounts, accounts with no email, and service accounts.

When you edit the connection, enter the Client Secret again before you save, because it is not shown.

To delete the connection, select the bin icon on its card. This also deletes the assets and their compliance status.

Was this article helpful?

Yes! No