Microsoft Azure Connector Guide

Microsoft Azure is a cloud computing service offered by Microsoft for building, testing, deploying, and managing applications and services through a global network of Microsoft-managed data centers. The Balbix integration with Microsoft Azure ingests data from core services such as Azure Virtual Machines, Azure Service Bus Messaging, Azure Key Vault, Azure Blob Storage, Azure Cosmos DB, Azure Kubernetes Service (AKS), Azure SQL Database, Azure AKS Deployments, and Azure Functions.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.

Integration Summary

The table below provides information about the integration type, asset types, and data types that are fetched by the Balbix connector for Microsoft Azure.

Prerequisites

To configure your Balbix connector, start by creating Microsoft Azure API credentials with the necessary permissions. These credentials will be used during the connector setup process. Here's what you need to complete:

1. Register an App: Set up an application in Microsoft Azure for connector integration.

2. Add API Permissions: Specify the APIs the app can access.

3. Add Permissions and Assign Roles: Ensure the app has the appropriate roles for data access.

4. Create an API Key: Generate an API key to authenticate the app with Balbix.

Register an App

1. Log in to the MS Azure portal and select Microsoft Entra ID from the left navigation panel.

2. On the Overview page, click + Add and select App Registration.

3. Enter the registration information for your application.

   • Name: Balbix

   • Supported account types: Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant)

   • (Optional) Redirect URI: Specify if desired

4. Click Register to create the registration application.

5. On the Overview page, copy the Application ID and the Directory ID and save them in a safe place to use later when configuring the Balbix connector.

Add API Permissions

Add API permissions after you have registered the Balbix app:

1. Under Manage on the Balbix App Registration page, select API Permissions then click + Add a permission.

2. On the Request API permissions page, select the APIs my organization uses tab.

3. Search for and select Windows Azure Service Management API.

4. Add permissions as follows:

   • Application

     • Directory.Read.All

     • User.Read.All

   • Delegated

     • User.Read

     • User.Read.All

5. Click Grant admin consent for Default Directory to apply the permissions.

Add Permissions and Assign Roles

To generate an API key, ensure that roles are assigned and the necessary permissions are added.

1. In the MS Azure portal, go to Subscriptions.

2. Choose the subscription where you want to create the custom role.

3. Go to the Access Control (IAM) tab and select the Roles tab.

4. Click Add > Add Custom Role.

5. Enter a custom role name and description.

6. Click the Permissions tab, then click + Add Permissions to open the Add permissions panel.

7. In the Search for a permission field, search for the permissions listed below:

   • Microsoft.AppConfiguration/configurationStores/ListKeyValue/action

   • Microsoft.Web/sites/config/list/Action

   • Microsoft.Storage/storageAccounts/queueServices/queues/read

   • Microsoft.Network/networkWatchers/queryFlowLogStatus/action

   • Microsoft.ContainerService/managedClusters/listClusterUserCredential/action

   • Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action

8. Click the permission card that displays based on your search, then click the checkboxes for the individual permissions as they are listed.

9. Click Review + create.

10. In the Access control (IAM) page, click the Role assignments tab to view the role assignments.

11. Click Add > Add role assignment.

12. In the Role tab, assign both your newly created custom IAM role and Reader role for the registered Balbix app service.

Create an API Key

To generate an API key from Microsoft Azure:

1. Go to the Azure Active Directory, click App registrations and select the Balbix application.

2. Select Certificates & secrets > Client secrets > New client secret.

3. Add a description for your client secret and select an expiration for the secret or specify a custom lifetime.

4. Click Add.

5. Copy the Client Secret and save to a safe place for use later when configuring the Balbix connector.

   Important: The Client Secret is never displayed after you leave the page. Be sure to save it!

Create and Configure the Connector

After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for Microsoft Azure.

Azure Cloud Services Supported

The following cloud services are ingested as assets via this connector:

API Documentation

To learn more about the Microsoft Azure API, see the references listed below:

• Azure REST API reference

• Register an app with Microsoft Entra ID