HomeGuidesTerms & ConceptsAPI DocumentationRelease NotesStatus

Azure Application Role Assignment

This page explains how to set application roles necessary to connect to Secberus.

Suggest Edits

Below are step-by-step instructions for assigning the Reader role to a Secberus-connected Azure AD App at the Subscription or Resource Group level in the Azure Portal.

At the end, you’ll also find a guide for granting User(s) access to provision Secberus-connected Apps with roles at both the Subscription and Resource Group levels.

When onboarding an Azure Data Provider onto the platform, you must grant permissions to read either a subscription or a resource group—only one is necessary. Assigning our App a role at the Subscription level gives it permissions to all of its nested Resource Groups, too, whereas granting permissions at the Resource Group level gives you fine-grained control over which parts of your cloud you want for us to access.

🚧

App Service Permissions

Note that you will need to add a Role Assignment at the subscription level for all of the following services:

  • Reader
  • Microsoft.Web/sites/config/list/action
  • Microsoft.Storage/storageAccounts/listkeys/action
  • Key Vault Reader

Granting Access to a Subscription

  1. Navigate to the Subscription service in your Azure Portal.
Navigate to 'Subscriptions'

Navigate to 'Subscriptions'

  1. Select the Subscription you would like to grant access to from the list.
Select a subscription

Select a subscription

  1. From the Subscription Overview page, select the Access control (IAM) tab on the left side of the screen.
Select 'Access control (IAM)'

Select 'Access control (IAM)'

  1. Click the ＋Add button toward the top-left of the page and select Add role assignment in the resultant dropdown menu.
Select '+Add role assignment'

Select '+Add role assignment'

  1. Leave the Assignment type set to Job function roles and select Next.
Select 'Next'

Select 'Next'

  1. Search for and select the Reader role and click Next.
Search for and select 'Reader' and then click 'Next'

Search for and select 'Reader' and then click 'Next'

  1. Click + Select members and then search for and select the entry for the app created for a Secberus data source:
Click '+ Select members' and then search for and select the Secberus app

Click '+ Select members' and then search for and select the Secberus app

  1. Confirm the app is listed under Selected members and click Select.
Confirm the app is under 'Selected members' and click 'Select'

Confirm the app is under 'Selected members' and click 'Select'

  1. Confirm the Selected role and Members are correct and select Review + assign.
Confirm the 'Selected role' and 'Members' then click 'Review + assign'

Confirm the 'Selected role' and 'Members' then click 'Review + assign'

  1. Confirm the Scope is correct and click Review + assign.
Confirm the 'Scope' and click 'Review + assign'

Confirm the 'Scope' and click 'Review + assign'

  1. Navigate to the Role assignments tab on the Access control (IAM) page and verify that the role assignment you’ve created is correct.
Navigate to 'Role assignments' and confirm the assignment

Navigate to 'Role assignments' and confirm the assignment

  1. Repeat these steps for the following permissions:
  • Microsoft.Web/sites/config/list/action
  • Microsoft.Storage/storageAccounts/listkeys/action
  • Key Vault Reader

👍

You have assigned an application role to your Secberus Application.

Now complete the Secberus onboarding by clicking "connect" on your Secberus Account.

Granting Access to a Resource Group

  1. Navigate to Resource groups in the Azure Portal.
Navigate to 'Resource groups'

Navigate to 'Resource groups'

  1. Select the Resource group you would like to grant access to from the list and follow the link in its Name.
Select a resource group

Select a resource group

  1. From the Resource group Overview page, select Access control (IAM).
Select 'Access control (IAM)'

Select 'Access control (IAM)'

  1. Click ＋Add button and select Add role assignment in the resultant dropdown menu:
Click '+ Add' and select 'Add role assignment'

Click '+ Add' and select 'Add role assignment'

  1. Leave the Assignment type set to Job function roles and select Next.
Select 'Next'

Select 'Next'

  1. Search for and select the Reader role and click Next.
Search for and select the 'Reader' role and click 'Next'

Search for and select the 'Reader' role and click 'Next'

  1. Click + Select members and then search for and select the Secberus app to assign.
Click '+ Select members' then search for and select the Secberus app

Click '+ Select members' then search for and select the Secberus app

  1. Confirm the app is under Selected members and click Select.
Confirm the app is under 'Selected members' and click 'Select'

Confirm the app is under 'Selected members' and click 'Select'

  1. Confirm the Selected role and Members and click Review + assign.
Confirm the 'Selected role' and 'Members' then click 'Review + assign'

Confirm the 'Selected role' and 'Members' then click 'Review + assign'

  1. Confirm the scope and select Review + assign.
Confirm the scope and select 'Review + assign'

Confirm the scope and select 'Review + assign'

  1. Repeat these steps for the following permissions:
  • Microsoft.Web/sites/config/list/action
  • Microsoft.Storage/storageAccounts/listkeys/action
  • Key Vault Reader

👍

You have assigned a resource group to your application.

Now complete the Secberus onboarding by clicking "connect" on your Secberus Account.

Updated 5 months ago

What’s Next