Azure Authentication

Azure collection uses an Entra ID app registration, also called a service principal. Ventra acquires tokens for the Azure Resource Manager and Microsoft Graph APIs on the server. Resource Manager access attaches as a role on each subscription, and Graph access needs tenant administrator consent.

FieldWhere it comes from
Tenant IDThe Entra ID directory overview
Client IDThe app registration overview
Client secretCertificates and secrets on the app registration
Subscription IDThe subscription you plan to collect
  1. Create an app registration in Entra ID and note the Tenant ID and Client ID.
  2. Create a client secret with an expiry that covers the engagement.
  3. Assign the read only role on the subscription, or deploy the Terraform module.
  4. Grant the Microsoft Graph application permissions and record tenant administrator consent.
  5. Open Configuration, Authentication, add a connection, and select Microsoft Azure.
  6. Enter the Tenant ID, Client ID, client secret, and Subscription ID, then run Validate connection.

Sign in logs need an Entra ID P1 or P2 license. Ventra does not switch on audit feeds. Confirm ingestion is already active in the client tenant.

Deploy with infrastructure as code

or
  • Terraform code: Custom ARM role definition and subscription assignment.

Policy references