Onboard Azure Subscription

Overview & Objectives

Purpose:

This document outlines the process for onboarding a single Azure subscription into the ARMO Platform. After onboarding, ARMO will have visibility into the account’s resources, enable governance/compliance policies, and monitor for risks

Prerequisites

Item	Requirement
ARMO Platform	You have Admin or Manager access to the ARMO Platform.
Microsoft Entra ID	You can register an application and grant admin consent for its Microsoft Graph permissions (Global Administrator or Privileged Role Administrator).
Azure subscription	You have Owner (or User Access Administrator) on the target subscription, to create the custom role and assign roles.

High level onboarding flow

The Azure onboarding process in ARMO establishes secure, read-only access so ARMO can continuously analyze your cloud configuration, compliance posture, and activity logs.

Get your Azure Subscription ID
Create an Azure App Registration
Grant Microsoft Graph API permissions
Generate a Client Secret
Create a Custom Azure Role for CSPM
Assign roles to the application
Connect subscription

[ARMO Platform]
│
▼
[Start Onboarding Wizard]
│
▼
[Azure Portal]
├── Register ARMO App
├── Create Secret
├── Create custom role
└── Assign Roles to the application
│
▼
[Return to ARMO → Enter Credentials]
│
▼
[Validation + Discovery]
│
▼
[Continuous Scanning & Compliance Insights]

Detailed Step-by-Step Onboarding

1. Get the subscription id

Go to Azure portal and search for Subscriptions.
Locate and copy your Subscription ID.

2. Go to ARMO Platform

Go to Settings --> Accounts
Click on the Microsoft Azure card and click Next

Enter the Microsoft subscription id
Enter a display name

3. Register ARMO as an Azure Application

Navigate to Azure Portal → App registrations.
Click + New registration.
Enter the name: cspm-security-application
Select the supported account type:
- Accounts in this organizational directory only – for a single tenant setup.
Click Register.
Copy the following values
1. Application (client) ID and paste it in the ARMO connection wizard
2. Directory (tenant) ID and paste it in the ARMO connection wizard

4. Grant Microsoft Graph API Permissions

Navigate to Azure Portal → App registrations.
Open cspm-security-application
Click API permissions
Click + Add a permission
Select Microsoft Graph
Select Application permissions
Search and add:
1. Directory.Read.All
2. Policy.Read.All
3. UserAuthenticationMethod.Read.All
Click Add permissions
Click Grant admin consent

Make sure to select Application permissions, not Delegated permissions — the ARMO integration uses these without a signed-in user. Admin consent is required before ARMO can use them.

5. Add a New Secret

Open the newly created application and go to Certificates & secrets.
Under Client secrets, click + New client secret.
Add a description (e.g: cspm-security-application) and set expiration to 730 days (24 months).
Click Add.
Copy the Secret Value and paste it in the ARMO connection wizard

📘
Client secret values cannot be viewed, except for immediately after creation. Be sure to save the secret when created before leaving the page.

6. Create an Azure Custom Role

This role grants ARMO secure read-only access to required Azure services.

In the Azure Portal, go to Subscriptions.
Select your subscription
In the subscription menu, select Access control (IAM).
Click + Add → Add custom role
Enter Role name: CSPM Access
Select Start from scratch → Next
Click Add permissions
1. Search and add: Microsoft.Web/sites/host/listkeys/action
2. Click Add permissions again and add: Microsoft.Web/sites/config/list/Action
Click Review + Create
Click Create

7. Assign Roles to the Application

In the Azure Portal, go to Subscriptions.
Select your subscription
In the subscription menu, select Access control (IAM).
Click + Add → Add role assignment.
Assign the custom CSPM role
1. Role: CSPM Access
2. Assign access to: Default
3. Members: Search and select the application "cspm-security-application"
4. Click Review + assign
Repeat the same process for:
1. Reader
2. Security Reader
Your application should now have three roles:
- CSPM Access
- Reader
- Security Reader
Click Connect account

📘
Optional: Key Vault Reader
To also cover Azure Key Vault in your compliance findings, you can optionally assign the built-in Key Vault Reader role to the same application on this subscription. It is optional — the connection succeeds without it — and it extends posture coverage to Key Vault resources.

After Onboarding

Once your Azure environment is connected:

ARMO automatically discovers Azure resources and begins scanning for compliance and configuration issues.
Connected subscriptions appear under Settings → Accounts → Azure(tab) in the ARMO Platform.
Compliance results typically appear within 60 minutes in the Compliance section (Cloud tab)

Troubleshooting

Issue	Likely cause	Suggested fix
Connection reports missing permissions	The custom role, Reader, or Security Reader is not assigned to the application on this subscription.	On the subscription's Access control (IAM), confirm all three roles are assigned to `cspm-security-application` (see step 7).
Microsoft Graph permissions show as not consented	Admin consent was not granted for the application permissions.	In the app's API permissions, click Grant admin consent and confirm the three permissions show as granted (see step 4).
ARMO cannot access the subscription	Wrong Subscription ID, or the application lacks Reader on the subscription.	Verify the Subscription ID entered in ARMO, and that Reader is assigned to the application (see steps 1 and 7).
Compliance findings do not appear	Initial discovery is still in progress.	Allow the first scan to complete; findings populate within about 60 minutes.

Updated 9 days ago

Did this page help you?