Microsoft Azure Setup Guide

This guide walks you through creating a Service Principal (App Registration) with read-only access to your Azure subscription for comprehensive security assessment.

Quick Start

The recommended method is to create a Service Principal with Client Secret. This involves registering an application in Microsoft Entra ID (formerly Azure AD) and assigning it read-only roles on your subscription.

Prerequisites

• Access to the Azure Portal with sufficient permissions to create App Registrations
• Owner or User Access Administrator role on the subscription(s) you want to scan
• Your Azure Subscription ID (found in Subscriptions blade)

Step 1: Create an App Registration

1. Sign in to the Azure Portal → Microsoft Entra ID → App registrations
2. Click "+ New registration"
3. Fill in the application details:
   • Name: SecureStack-Security-Scanner
   • Supported account types: "Accounts in this organizational directory only"
   • Redirect URI: Leave blank (not needed for this use case)
4. Click "Register"
5. On the Overview page, copy these values (you'll need them for SecureStack):
   • Application (client) ID
   • Directory (tenant) ID

Step 2: Create a Client Secret

1. In the App Registration, go to "Certificates & secrets"
2. Click "+ New client secret"
3. Fill in the details:
   • Description: SecureStack Assessment Access
   • Expires: Select an appropriate duration (12 or 24 months recommended)
4. Click "Add"
5. Important: Copy the Value immediately — you won't be able to see it again! This is your Client Secret.

Step 3: Assign Roles to the Subscription

1. Go to Subscriptions in the Azure Portal
2. Select the subscription you want to scan
3. Go to "Access control (IAM)"
4. Click "+ Add" → "Add role assignment"
5. On the Role tab:
   • Search for and select "Reader"
   • Click "Next"
6. On the Members tab:
   • Select "User, group, or service principal"
   • Click "+ Select members"
   • Search for SecureStack-Security-Scanner
   • Select it and click "Select"
7. Click "Review + assign"
8. Repeat steps 4-7 to add the "Security Reader" role

Using Azure CLI

You can also create the Service Principal and assign roles using the Azure CLI:

# Login to Azure
az login

# Get your subscription ID
SUBSCRIPTION_ID=$(az account show --query id -o tsv)
echo "Subscription ID: $SUBSCRIPTION_ID"

# Create the Service Principal with Reader role
az ad sp create-for-rbac \
  --name "SecureStack-Security-Scanner" \
  --role "Reader" \
  --scopes "/subscriptions/$SUBSCRIPTION_ID"

# The command above outputs:
# {
#   "appId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",  <- Client ID
#   "displayName": "SecureStack-Security-Scanner",
#   "password": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",    <- Client Secret
#   "tenant": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"  <- Tenant ID
# }

# Add Security Reader role
APP_ID="<appId from above>"
az role assignment create \
  --assignee $APP_ID \
  --role "Security Reader" \
  --scope "/subscriptions/$SUBSCRIPTION_ID"

Required Information Summary

After completing the setup, you'll need to provide these four values to SecureStack:

Required Roles

At minimum, the Service Principal needs these roles for comprehensive security assessment:

What SecureStack Scans

Once connected, SecureStack performs read-only analysis of your Azure subscription for:

• Virtual Machines: VM configurations, disk encryption, network security groups
• Storage Accounts: Access policies, encryption, public access, HTTPS enforcement
• Azure SQL: Database security, firewall rules, TDE, auditing settings
• Key Vault: Access policies, soft delete, purge protection, secrets rotation
• App Services: HTTPS enforcement, authentication, TLS versions, managed identity
• AKS: Kubernetes clusters, RBAC configuration, network policies, pod security
• Networking: VNets, NSGs, Application Gateways, Azure Firewall, Private Endpoints
• Microsoft Defender: Security alerts, recommendations, secure score, compliance
• Activity Logs: Audit configuration, diagnostic settings, log retention

Multi-Subscription Setup

For organizations with multiple Azure subscriptions:

Option A: Per-Subscription Assignment

Assign the Reader and Security Reader roles to each subscription individually. Use the same Service Principal but repeat the role assignment steps for each subscription.

Option B: Management Group Level

If you use Azure Management Groups, you can assign roles at the management group level to grant access to all subscriptions within the group:

# Assign Reader role at Management Group level
az role assignment create \
  --assignee $APP_ID \
  --role "Reader" \
  --scope "/providers/Microsoft.Management/managementGroups/<management-group-id>"

Testing Your Setup

After creating the Service Principal, verify the credentials work:

# Login with the Service Principal
az login --service-principal \
  -u "APPLICATION_CLIENT_ID" \
  -p "CLIENT_SECRET" \
  --tenant "TENANT_ID"

# Set the subscription context
az account set --subscription "SUBSCRIPTION_ID"

# Test read access to various services
az vm list --output table
az storage account list --output table
az network nsg list --output table
az sql server list --output table

Security Best Practices

• Use client secrets with the shortest acceptable expiration period
• Consider certificate-based authentication for production environments
• Enable audit logging for Service Principal activities
• Scope permissions to specific subscriptions when possible
• Rotate client secrets before expiration (set calendar reminders)
• Review and revoke unused App Registrations regularly
• Use Azure Policy to monitor Service Principal usage
• Enable Conditional Access policies for added security

Troubleshooting

"AADSTS7000215: Invalid client secret" error

The client secret has expired or is incorrect. Generate a new client secret and update your configuration.

"AuthorizationFailed" error

The Service Principal doesn't have sufficient permissions. Verify that the Reader role is assigned at the subscription level (not just a resource group).

Can't find the App Registration

Make sure you're looking in the correct Azure AD tenant. App Registrations are tenant-specific, not subscription-specific.

Missing resources in scan

Some resources may require additional role assignments (e.g., Key Vault requires explicit access policies). Check the service-specific documentation for any additional requirements.