Docs
HomeGitHubSign Up

Onboard Azure Tenant

Onboard Azure Tenant (Multi-Subscription)

This guide explains how to connect an Azure tenant or management group to ARMO using the Tenant (Multi-Subscription) integration.

After onboarding, ARMO can discover Azure resources across the connected tenant or management group and continuously monitor cloud compliance findings, misconfigurations, and risks across multiple Azure subscriptions.

Overview

Use the Azure Tenant (Multi-Subscription) onboarding flow when you want to connect multiple Azure subscriptions under a single tenant or management group.

During the onboarding process, you will:

  1. Start the Azure connection flow from ARMO.
  2. Select Tenant (Multi-Subscription) as the integration scope.
  3. Temporarily elevate access in Microsoft Entra ID.
  4. Copy the Azure Tenant ID (and, to scope to a specific management group, its Management Group ID).
  5. Register an Azure application.
  6. Add the required Microsoft Graph API permissions.
  7. Create a client secret.
  8. Create a custom Azure role.
  9. Assign the required roles to the Azure application.
  10. Complete the connection in ARMO.

Prerequisites

Before you begin, make sure you have the required permissions in both ARMO and Azure.

RequirementDescription
ARMO permissionsYou have an Admin or Manager role in ARMO.
Azure tenant accessYou have access to the Azure tenant you want to connect.
Microsoft Entra ID permissionsYou can access Microsoft Entra ID, manage app registrations, and grant admin consent.
Azure management group permissionsYou can access Management Groups, create custom roles, and assign roles.
Integration scopeDecide whether to connect the entire organization or a specific management group.

To manage permissions across subscriptions and management groups, you must temporarily elevate access in Microsoft Entra ID during the onboarding process. You can disable this setting after onboarding is complete.

Integration scope

When onboarding Azure Tenant (Multi-Subscription), you can connect either your entire tenant or a specific management group. This choice controls the Management Group ID value in the wizard.

ScopeWhat to do
Entire tenantLeave Management Group ID empty. ARMO connects at the tenant root, covering every subscription in the tenant.
Specific management groupEnter the Management Group ID of the management group you want to scope to.

High-level onboarding flow

ARMO Platform
  |
  v
Settings > Accounts > Azure > Connect
  |
  v
Select Tenant (Multi-Subscription)
  |
  v
Microsoft Entra ID / Azure Portal
  |-- Elevate access
  |-- Copy Tenant ID (Management Group ID only to scope to a specific management group)
  |-- Register Azure application
  |-- Add API permissions
  |-- Grant admin consent
  |-- Create client secret
  |-- Create custom role
  |-- Assign roles
  |
  v
Return to ARMO
  |
  v
Enter the required Azure details
  |
  v
Connect the tenant

Step-by-step onboarding

Step 1: Start Azure onboarding in ARMO

In ARMO, start the Azure account connection flow.

  1. Go to Settings --> Accounts.
  2. Select the Azure tab.
  3. Click Connect.

Step 2: Select Tenant (Multi-Subscription)

In the Connect Azure dialog, select the Azure integration scope.

  1. Under What will be the integration scope?, select Tenant (Multi-Subscription).
  2. Under Choose Security Feature, keep CSPM (Cloud Compliance) selected.
  3. Click Next.

Select Tenant (Multi-Subscription) when you want ARMO to monitor multiple Azure subscriptions under a tenant or management group.

Step 3: Elevate access for tenant management

To manage permissions across all subscriptions, temporarily elevate your access in Microsoft Entra ID.


  1. In the Azure Portal, search for Microsoft Entra ID.
  2. From the left menu, select Properties.
  3. Under Access management for Azure resources, toggle the switch to Yes.
  4. Click Save.
  5. Return to the ARMO onboarding wizard and click Continue.

Elevated access is required to manage permissions across subscriptions and management groups during onboarding. You can toggle Access management for Azure resources back to No after the onboarding process is complete.

Step 4: Get the Tenant ID and Management Group ID

Next, collect the Azure identifiers required to define the tenant or management group scope ARMO should connect to.

  1. In the Azure Portal, search for Microsoft Entra ID.
  2. Copy the Tenant ID.
  3. Return to the ARMO onboarding wizard and paste the value into Tenant ID.
  4. Set the Management Group ID according to the scope you want:
    • To connect the entire tenant, leave Management Group ID empty. ARMO connects at the tenant root and covers all subscriptions in the tenant.
    • To connect a specific management group, search for Management Groups in the Azure Portal, copy its Management Group ID, and paste it into Management Group ID.
  5. In Name, enter a name for the Azure connection as it should appear in ARMO.
  6. Click Continue.

The Management Group ID field is optional. Leave it empty to connect the entire tenant, or provide a management group ID to scope the connection to that management group and the subscriptions beneath it.

The Name field is used to identify this Azure connection in ARMO. Use a clear name that helps your team recognize the connected tenant or management group.

Step 5: Register an Azure application

Next, create an Azure application that ARMO will use to access the connected tenant or management group.

  1. In the Azure Portal, go to Microsoft Entra ID.

  2. From the left menu, select App registrations.

  3. Click + New registration.

  4. In Name, enter a name for the application, for example: CSPM-Security.

    The application name can be customized. Use a clear name, such as CSPM-Security, so it is easy to identify later when assigning roles.

  5. Under Supported account types, select Accounts in this organizational directory only.

  6. Click Register.

  7. After the application is created, copy the Application (client) ID.

  8. Return to the ARMO onboarding wizard and paste the value into Application (Client) ID.

  9. Click Continue.

Step 6: Add Microsoft Graph API permissions

Next, add the required Microsoft Graph application permissions to the Azure application.

  1. In the Azure Portal, go to Microsoft Entra ID.

  2. From the left menu, select App registrations.

  3. Select the application you created.

  4. From the application menu, select API permissions.

  5. Click + Add a permission.

  6. Select Microsoft Graph.

  7. Select Application permissions.

    Make sure to select Application permissions, not Delegated permissions. The ARMO integration uses these permissions without a signed-in user.

  8. Search for and select the following permissions:

    • Directory.Read.All
    • Policy.Read.All
    • UserAuthenticationMethod.Read.All

  9. Click Add permissions.

  10. Click Grant admin consent for [Directory Name].

    Admin consent is required before ARMO can use the selected Microsoft Graph permissions.

  11. Confirm that the permissions show as granted.

  12. Return to the ARMO onboarding wizard and click Continue.

Step 7: Create a client secret

Next, create a client secret for the Azure application and copy the secret value into ARMO.


  1. In the Azure Portal, go to Microsoft Entra ID.

  2. From the left menu, select App registrations.

  3. Select the application you created.

  4. From the application menu, select Certificates & secrets.

  5. Under Client secrets, click + New client secret.

  6. In Description, enter a description for the secret, for example: CSPM-Security.

  7. In Expires, select 730 days (24 months).

  8. Click Add.

  9. Copy the client secret Value.

  10. Return to the ARMO onboarding wizard and paste the value into Client Secret.

  11. Click Continue.

Step 8: Create a custom Azure role

Next, create a custom Azure role with the additional permissions required by ARMO.


  1. In the Azure Portal, search for Management Groups.

  2. Select the management group you are connecting, or the tenant root group.

  3. From the left menu, select Access control (IAM).

  4. Click + Add.

  5. Select Add custom role.

  6. In Role name, enter a name for the custom role, for example: CSPM Access.

  7. Select Start from scratch

  8. Click Next.

  9. Click Add permissions.

  10. Search for and add the following permission: Microsoft.Web/sites/host/listkeys/action.

  11. Click Add permissions again.

  12. Search for and add the following permission: Microsoft.Web/sites/config/list/Action.

  13. Review the selected permissions.

  14. Click Review + create.

  15. Click Create.

  16. Return to the ARMO onboarding wizard and click Continue.

Step 9: Grant access to roles

Next, assign the required Azure roles to the application you created.


  1. In the Azure Portal, search for Management Groups.

  2. Select the management group you are connecting.

  3. From the left menu, select Access control (IAM).

  4. Go to the Role assignments tab.

  5. Click + Add.

  6. Select Add role assignment.

  7. In the Role list, search for and select the custom role you created, for example: CSPM Access.

  8. Click Next.

  9. Leave Assign access to set to the default value.

  10. Click Select members.

  11. Search for the name of the app registration you created, for example: CSPM-Security.

  12. Select the application.

  13. Click Select.

  14. Click Review + assign.

  15. Repeat the same process to also assign the following roles to the application:

    • Reader
    • Security Reader

  16. Return to the ARMO onboarding wizard and click Connect.

  17. After the connection is created successfully, click View account.


Assign at the management group so subscriptions inherit access

Assign the custom role, Reader, and Security Reader at the management group (or tenant root) you are connecting, so every subscription beneath it inherits the access. If a subscription in scope does not inherit these roles, the connection reports missing permissions for that subscription.

Optional: Key Vault Reader

To also cover Azure Key Vault in your compliance findings, you can optionally assign the built-in Key Vault Reader role to the same application, at the same scope. It is optional — the connection succeeds without it — and it extends posture coverage to Key Vault resources.

After onboarding

After the Azure tenant is connected, ARMO begins discovering Azure resources under the connected tenant or management group.

Cloud compliance findings and misconfigurations appear in ARMO after the initial discovery is complete.

Elevated access is used only during onboarding to allow permission configuration across subscriptions and management groups. After onboarding is complete, Access management for Azure resources can be set back to No.


Troubleshooting

IssueLikely causeSuggested fix
Connection fails with no subscriptions foundElevated access was not enabled, so the ARMO application cannot enumerate subscriptions beneath the tenant root.In Microsoft Entra ID → Properties, set Access management for Azure resources to Yes, then retry the connection (see Step 3).
Connection reports no access to the management groupThe application lacks Reader on the target management group, or the Management Group ID is wrong.Verify the Management Group ID, and confirm the Reader role is assigned at that management group (see Step 9).
Connection reports missing permissions on one or more subscriptionsThe custom role, Reader, or Security Reader did not propagate to every in-scope subscription.Assign the roles at the management group (or tenant root) rather than per-subscription, so all subscriptions inherit them (see Step 9).
Compliance findings do not appearInitial discovery is still in progress.Allow the first scan to complete; findings populate after the initial discovery.

Updated 2 days ago

Did this page help you?