Onboard Azure Tenant (Multi-Subscription)

This guide explains how to connect an Azure tenant or management group to ARMO using the Tenant (Multi-Subscription) integration.

After onboarding, ARMO can discover Azure resources across the connected tenant or management group and continuously monitor cloud compliance findings, misconfigurations, and risks across multiple Azure subscriptions.

Overview

Use the Azure Tenant (Multi-Subscription) onboarding flow when you want to connect multiple Azure subscriptions under a single tenant or management group.

During the onboarding process, you will:

1. Start the Azure connection flow from ARMO.
2. Select Tenant (Multi-Subscription) as the integration scope.
3. Temporarily elevate access in Microsoft Entra ID.
4. Copy the Azure Tenant ID and Management Group ID.
5. Register an Azure application.
6. Add the required Microsoft Graph API permissions.
7. Create a client secret.
8. Create a custom Azure role.
9. Assign the required roles to the Azure application.
10. Complete the connection in ARMO.

Prerequisites

Before you begin, make sure you have the required permissions in both ARMO and Azure.

Integration scope

When onboarding Azure Tenant (Multi-Subscription), you can connect either your entire organization or a specific management group.

High-level onboarding flow

ARMO Platform
  |
  v
Settings > Accounts > Azure > Connect
  |
  v
Select Tenant (Multi-Subscription)
  |
  v
Microsoft Entra ID / Azure Portal
  |-- Elevate access
  |-- Copy Tenant ID and Management Group ID
  |-- Register Azure application
  |-- Add API permissions
  |-- Grant admin consent
  |-- Create client secret
  |-- Create custom role
  |-- Assign roles
  |
  v
Return to ARMO
  |
  v
Enter the required Azure details
  |
  v
Connect the tenant

Step-by-step onboarding

Step 1: Start Azure onboarding in ARMO

In ARMO, start the Azure account connection flow.

1. Go to Settings --> Accounts.
2. Select the Azure tab.
3. Click Connect.

Step 2: Select Tenant (Multi-Subscription)

In the Connect Azure dialog, select the Azure integration scope.

1. Under What will be the integration scope?, select Tenant (Multi-Subscription).
2. Under Choose Security Feature, keep CSPM / Cloud Compliance selected.
3. Click Next.

Step 3: Elevate access for tenant management

To manage permissions across all subscriptions, temporarily elevate your access in Microsoft Entra ID.

1. In the Azure Portal, search for Microsoft Entra ID.
2. From the left menu, select Properties.
3. Under Access management for Azure resources, toggle the switch to Yes.
4. Click Save.
5. Return to the ARMO onboarding wizard and click Continue.

Step 4: Get the Tenant ID and Management Group ID

Next, collect the Azure identifiers required to define the tenant or management group scope ARMO should connect to.

1. In the Azure Portal, search for Microsoft Entra ID.
2. Copy the Tenant ID.
3. Return to the ARMO onboarding wizard and paste the value into Tenant ID.
4. In the Azure Portal, search for Management Groups.
5. Copy the relevant Management Group ID:
   • To connect the entire organization, use the Tenant ID as the Management Group ID.
   • To connect a specific management group, locate the relevant management group and copy its Management Group ID.
6. Return to the ARMO onboarding wizard and paste the value into Management Group ID.
7. In Name, enter a name for the Azure connection as it should appear in ARMO.
8. Click Continue.

Step 5: Register an Azure application

Next, create an Azure application that ARMO will use to access the connected tenant or management group.

1. In the Azure Portal, go to Microsoft Entra ID.

2. From the left menu, select App registrations.

3. Click + New registration.

4. In Name, enter a name for the application, for example: CSPM-Security.

   

   The application name can be customized. Use a clear name, such as CSPM-Security, so it is easy to identify later when assigning roles.

5. Under Supported account types, select Accounts in this organizational directory only.

6. Click Register.

7. After the application is created, copy the Application (client) ID.

   

8. Return to the ARMO onboarding wizard and paste the value into Application (Client) ID.

9. Click Continue.

Step 6: Add Microsoft Graph API permissions

Next, add the required Microsoft Graph application permissions to the Azure application.

1. In the Azure Portal, go to Microsoft Entra ID.

2. From the left menu, select App registrations.

3. Select the application you created.

4. From the application menu, select API permissions.

5. Click + Add a permission.

   

6. Select Microsoft Graph.

   

7. Select Application permissions.

   

   Make sure to select Application permissions, not Delegated permissions. The ARMO integration uses these permissions without a signed-in user.

8. Search for and select the following permissions:

   • Directory.Read.All
   • Policy.Read.All
   • UserAuthenticationMethod.Read.All

9. Click Add permissions.

10. Click Grant admin consent for [Directory Name].

    

    Admin consent is required before ARMO can use the selected Microsoft Graph permissions.

11. Confirm that the permissions show as granted.

12. Return to the ARMO onboarding wizard and click Continue.

Step 7: Create a client secret

Next, create a client secret for the Azure application and copy the secret value into ARMO.

1. In the Azure Portal, go to Microsoft Entra ID.

2. From the left menu, select App registrations.

3. Select the application you created.

4. From the application menu, select Certificates & secrets.

5. Under Client secrets, click + New client secret.

   

6. In Description, enter a description for the secret, for example: CSPM-Security.

7. In Expires, select 730 days (24 months).

8. Click Add.

9. Copy the client secret Value.

10. Return to the ARMO onboarding wizard and paste the value into Client Secret.

11. Click Continue.

Step 8: Create a custom Azure role

Next, create a custom Azure role with the additional permissions required by ARMO.

1. In the Azure Portal, search for Management Groups.

2. Select the management group you are connecting, or the tenant root group.

3. From the left menu, select Access control (IAM).

4. Click + Add.

5. Select Add custom role.

   

6. In Role name, enter a name for the custom role, for example: CSPM Access.

7. Select Start from scratch

   

8. Click Next.

9. Click Add permissions.

10. Search for and add the following permission: Microsoft.Web/sites/host/listkeys/action.

11. Click Add permissions again.

12. Search for and add the following permission: Microsoft.Web/sites/config/list/Action.

13. Review the selected permissions.

    

14. Click Review + create.

15. Click Create.

16. Return to the ARMO onboarding wizard and click Continue.

Step 9: Grant access to roles

Next, assign the required Azure roles to the application you created.

1. In the Azure Portal, search for Management Groups.

2. Select the management group you are connecting.

3. From the left menu, select Access control (IAM).

4. Go to the Role assignments tab.

5. Click + Add.

6. Select Add role assignment.

   

7. In the Role list, search for and select the custom role you created, for example: CSPM Access.

8. Click Next.

9. Leave Assign access to set to the default value.

10. Click Select members.

11. Search for the name of the app registration you created, for example: CSPM-Security.

12. Select the application.

13. Click Select.

    

14. Click Review + assign.

15. Repeat the same process to also assign the following roles to the application:

    • Reader
    • Security Reader

16. Return to the ARMO onboarding wizard and click Connect.

17. After the connection is created successfully, click View account.

After onboarding

After the Azure tenant is connected, ARMO begins discovering Azure resources under the connected tenant or management group.

Cloud compliance findings and misconfigurations appear in ARMO after the initial discovery is complete.