---
title: "Microsoft Azure Connector Guide"
slug: "microsoft-azure-v2"
updated: 2026-07-23T06:38:55Z
published: 2026-07-23T06:38:55Z
canonical: "docs.safe.security/microsoft-azure-v2"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Azure Connector Guide

Microsoft Azure is a cloud computing service offered by Microsoft for building, testing, deploying, and managing applications and services through a global network of Microsoft-managed data centers. The **Balbix integration with Microsoft Azure** ingests data from core services such as Azure Virtual Machines, Azure Service Bus Messaging, Azure Key Vault, Azure Blob Storage, Azure Cosmos DB, Azure Kubernetes Service (AKS), Azure SQL Database, Azure AKS Deployments, and Azure Functions.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.

#### Integration Summary

The table below provides information about the integration type, asset types, and data types that are fetched by the Balbix connector for Microsoft Azure.

| **Integration Type** | Fetch: An inbound API integration used to retrieve IT cloud assets, misconfigurations, and tags. |
| --- | --- |
| **Types of Assets Fetched** | Infrastructure cloud resources such as virtual machines, databases, containers, serverless functions, Identity and Access Management (IAM) resources. |
| **Types of Data Fetched** | Asset names, configurations, hardware information, interface information (MAC address, IP address), OS information, BIOS information, system information, relevant timestamps such as “first observed” and “last observed”, tags. |

#### Prerequisites

To configure your Balbix connector, start by creating Microsoft Azure API credentials with the necessary permissions. These credentials will be used during the connector setup process. Here's what you need to complete:

1. **Register an App:** Set up an application in Microsoft Azure for connector integration.
2. **Add API Permissions:** Specify the APIs the app can access.
3. **Add Permissions and Assign Roles:** Ensure the app has the appropriate roles for data access.
4. **Create an API Key:** Generate an API key to authenticate the app with Balbix.

**Register an App**

1. Log in to the MS Azure portal and select **Microsoft Entra ID** from the left navigation panel.
2. On the Overview page, click **+ Add** and select **App Registration**.
3. Enter the registration information for your application.
  - **Name:** Balbix
  - **Supported account types:** Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant)
  - **(Optional) Redirect URI:** Specify if desired
4. Click **Register** to create the registration application.
5. On the Overview page, copy the **Application ID** and the **Directory ID** and save them in a safe place to use later when configuring the Balbix connector.

**Add API Permissions**

Add API permissions after you have registered the Balbix app:

1. Under **Manage** on the Balbix App Registration page, select **API Permissions** then click **+ Add a permission**.
2. On the Request API permissions page, select the **APIs my organization uses** tab.
3. Search for and select **Windows Azure Service Management API**.
4. Add permissions as follows:
  - **Application**
    - Directory.Read.All
    - User.Read.All
  - **Delegated**
    - User.Read
    - User.Read.All
5. Click **Grant admin consent** **for Default Directory** to apply the permissions.

**Add Permissions and Assign Roles**

To generate an API key, ensure that roles are assigned and the necessary permissions are added.

1. In the MS Azure portal, go to **Subscriptions**.
2. Choose the subscription where you want to create the custom role.
3. Go to the **Access Control (IAM)** tab and select the **Roles** tab.
4. Click **Add > Add Custom Role**.
5. Enter a custom role name and description.
6. Click the **Permissions** tab, then click **+ Add Permissions** to open the Add permissions panel.
7. In the **Search for a permission** field, search for the permissions listed below:
  - Microsoft.AppConfiguration/configurationStores/ListKeyValue/action
  - Microsoft.Web/sites/config/list/Action
  - Microsoft.Storage/storageAccounts/queueServices/queues/read
  - Microsoft.Network/networkWatchers/queryFlowLogStatus/action
  - Microsoft.ContainerService/managedClusters/listClusterUserCredential/action
  - Microsoft.ContainerService/managedClusters/listClusterMonitoringUserCredential/action
8. Click the permission card that displays based on your search, then click the checkboxes for the individual permissions as they are listed.
9. Click **Review + create**.
10. In the Access control (IAM) page, click the **Role assignments** tab to view the role assignments.
11. Click **Add > Add role assignment**.
12. In the **Role** tab, assign both your newly created **custom IAM role** and **Reader** role for the registered Balbix app service.

**Create an API Key**

To generate an API key from Microsoft Azure:

1. Go to the Azure Active Directory, click **App registrations** and select the **Balbix** application.
2. Select **Certificates & secrets > Client secrets > New client secret**.
3. Add a description for your client secret and select an expiration for the secret or specify a custom lifetime.
4. Click **Add**.
5. Copy the Client Secret and save to a safe place for use later when configuring the Balbix connector.

**Important:** The Client Secret is never displayed after you leave the page. Be sure to save it!

#### Create and Configure the Connector

After you have completed the prerequisites, follow these steps to create and configure your Balbix connector for Microsoft Azure.

[Embedded content](https://scribehow.com/embed/Microsoft_Azure_Connector_Guide__E5dDueOXSRmgyW3xv8aI4Q?as=scrollable)

#### Azure Cloud Services Supported

The following cloud services are ingested as assets via this connector:

| Azure App Service / Web Apps |
| --- |
| Azure Blob Storage |
| Azure Cache for Redis |
| Azure Container Instances |
| Azure Cosmos DB |
| Azure Database for MySQL |
| Azure Database for PostgreSQL |
| Azure Functions Serverless Compute |
| Azure Key Vault |
| Azure Kubernetes Service (AKS) |
| Azure Service Bus |
| Azure SQL |
| Azure SQL Managed Instances |
| Azure SQL Virtual Machines |
| Azure Storage Accounts |
| Azure Synapse Analytics |
| Azure Virtual Machine Scale Sets |
| Azure Virtual Machines |

#### API Documentation

To learn more about the Microsoft Azure API, see the references listed below:

- [Azure REST API reference](https://learn.microsoft.com/en-us/rest/api/azure/)
- [Register an app with Microsoft Entra ID](https://learn.microsoft.com/en-us/power-apps/developer/data-platform/walkthrough-register-app-azure-active-directory)