Microsoft Azure

Purpose

The Azure connector uses a read-only service principal to inventory subscriptions, resource groups, virtual machines, network security groups and public IP exposure, feeding cloud asset, patching and attack-surface controls.

Requirements

• An Azure subscription with Entra ID app registration and service principal creation rights
• The Reader role assigned to the service principal at the subscription or management group scope
• Azure Policy or Azure Monitor read access for configuration and patch compliance evidence, where used

Permissions

• Reader role at subscription or management group scope — read all resource configuration
• Log Analytics Reader — optional, for patch compliance and monitoring data
• Security Reader — optional, for Microsoft Defender for Cloud findings

Setup

1. 1
   Register an app and service principal

   Create an Entra ID app registration and its associated service principal for AssurIQ.
2. 2
   Assign the Reader role

   Assign the Reader role (and Security Reader/Log Analytics Reader if used) at the subscription or management group scope.
3. 3
   Create a client secret or certificate

   Generate a client secret or certificate credential and store it in AssurIQ's Credential Vault.
4. 4
   Connect in AssurIQ

   In Integrations, add the tenant ID, subscription(s) and service principal credential.
5. 5
   Verify inventory

   Confirm VMs, network security groups and public IPs populate under Asset Inventory and Attack Surface.

Verification

• Subscriptions and resource groups appear in Asset Inventory with correct resource counts
• Network security group rules and public IP exposure populate under Attack Surface
• Defender for Cloud findings appear where Security Reader is granted

Data collected

• Subscription, resource group and resource inventory
• Virtual machine OS, size and patch compliance status
• Network security group rules and public IP assignments
• Defender for Cloud recommendations, where licensed and granted

Security model

The service principal holds only Reader-tier roles and cannot create, modify or delete Azure resources. Client secrets are stored encrypted with an expiry reminder; certificate-based credentials are supported for longer-lived, more auditable authentication.

Common errors

• AIQ-INT-001Integration disconnected
  The connector token expired or was revoked. Data from this system is stale.

Troubleshooting

• If some subscriptions are missing, confirm the Reader role was assigned at a management group covering all of them, or add each subscription individually.
• If Defender for Cloud data is absent, confirm the Security Reader role was granted in addition to Reader.

Disconnect

1. Disconnect Azure from AssurIQ Integrations.
2. Remove the Reader (and optional Security/Log Analytics Reader) role assignment from the service principal, then delete the app registration.