Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Log in to Azure. Select Reservations.

  2. Select the tab 'Role Assignment'. Click +AddAdd role assignments.

    a. Under the tab 'Job function roles' select Reservations Reader → Next.

    b. Under the tab 'Members' select the following settings:
    Role: Reservations Reader
    Assign access to: User, group, or service principal
    Members: click +Select members → start typing the name of the Azure application created for Cloudaware access (in this guide, cloudaware-api-access)Select.

    Click Review + assign.

Note

Please allow up to 24 hours for Cloudaware to collect Azure reservations data.

  1. To view Azure Reservations and related data, go to Cloudaware CMDB Navigator. Select MICROSOFT AZURE → RESERVATIONS.

    Azure start guide - additional permissions - reservations - reservations in CMDB.pngImage Added

Azure Kubernetes

Cloudaware supports auto-discovery of AKS Clusters and AKS Cluster Agent Pool Profiles by default. Grant Cloudaware the permission Microsoft.ContainerService/managedClusters/listClusterUserCredential/read to enable the discovery and collection of AKS Cluster objects.

...

  1. Log in to Azure. Select Subscriptions.

  2. Select the subscription. Go to 'Access Control (IAM)' on the left. Click +AddAdd role assignment:

    a. Under the tab 'Role': in 'Job function roles' select Azure Kubernetes Service Cluster User Role → Next.

    b. Under the tab 'Members':
    Assign access to: User, group, or service principal
    Members: click +Select members → start typing the name of the Azure application created for Cloudaware access (in this guide, cloudaware-api-access)Select.

    Click Review + assign.

  3. To view Azure AKS resources, go to Cloudaware CMDB Navigator. Select MICROSOFT AZURE → COMPUTE → AKS.

...

  1. Log in to Azure. Select App registrations.

  2. Select the Azure application created for Cloudaware access (in this guide, cloudaware-api- access). Go to API permissions → Add a permission.

  3. Select Microsoft Graph → Application permissions:

    In DeviceManagementManagedDevices: select DeviceManagementManagedDevices.Read.All → check the box → click Add permissions.
    In DeviceManagementConfiguration: select DeviceManagementConfiguration.Read.All → check the box → click Add permissions.

  4. Click Grant admin consent for <Directory Name> to populate permissions.

  5. To view Azure Active Directory Devices and related data, go to Cloudaware CMDB Navigator. Select MICROSOFT AZURE → SECURITY, IDENTITY, COMPLIANCE → Active Directory → Azure Active Directory Devices.

    Azure start guide - additional permissions - Intune - AD devices in CMDB.pngImage Added



    The following Azure Active Directory objects managed by Intune* are supported:

    Azure Active Directory DevicesDevice
    Azure Active Directory Device Config
    Azure Active Directory Device Fact
    Azure Active Directory Device MountPoint

...

To tag Azure resources directly from Cloudaware using Tag Analyzer, assign the Tag Contributor* role:

 

  1. Log in to the Azure portal. Select Subscriptions.

  2. Select the subscription → go to 'Access Control (IAM)' on the left. Click +AddAdd role assignment.

    a. Under the tab 'Job function roles' select Tag Contributor** → Next.

    b. Under the tab 'Members' select the following settings:
    Assign access to: User, group, or service principal
    Members: click +Select members → start typing the name of the Azure application created for Cloudaware access (in this guide, cloudaware-api-access)Select.

    Click Review + assign.

*You can also create a custom role to define the scope of permissions for tagging.

...