Azure
Adding an Azure subscription lets Cloud Defense read its resources into Inventory and run posture monitoring checks against them. Cloud Defense signs in to the subscription as a user-assigned managed identity you create, through a federated credential. No client secret is created or stored anywhere.
Azure accounts are Read Only. Cloud Defense doesn't apply remediation actions in Azure, and the provisioning command grants the identity a read-only role.
Before you start
| Prerequisite | Why it's needed | Where to check |
|---|---|---|
| The subscription ID (a GUID) | It identifies the subscription in Cloud Defense | Azure portal: Subscriptions |
| Permission to create a subscription-scoped deployment, including a custom role definition and a role assignment (Owner, or User Access Administrator plus Contributor) | The provisioning command creates a resource group, an identity, a custom role, and assigns it | Subscriptions > your subscription > Access control (IAM) |
| Azure CLI, or Azure Cloud Shell, signed in to the tenant | The command uses az stack sub create | Cloud Shell has the CLI preinstalled |
Set up an Azure account
- In Cloud Defense, go to Settings > Cloud Accounts and click Add Cloud Account.
- Cloud Provider: Azure. Enter the Azure Subscription ID, a name, a project, and the Account Environment. Cloud Defense Access is Read Only; it's the only level offered for Azure.
- Save. You land on the Provision page. Copy the Azure CLI command shown there and run it in Cloud Shell or a terminal signed in to your tenant. It downloads two Bicep files and creates a deployment stack named FireMonCloudDefenseStack in the subscription. The
--location westus2in the command is where the FireMonCloudDefense resource group and identity are created; change it if you prefer another region. - The command prints a Tenant ID and a Client ID. Back on the Provision page, enter both and save. You see This account has been successfully updated. and the first discovery starts on its own. The page also offers a View your Findings link to Posture Monitoring; findings appear there once the first checks have run.
What the command creates
| Resource | Purpose |
|---|---|
| Resource group FireMonCloudDefense | Holds the identity |
| User-assigned managed identity FireMonCloudDefenseIdentity, with a federated credential named CloudDefense | The identity Cloud Defense signs in as. Its federated credential trusts Cloud Defense's identity provider for your client only |
| A custom role, FireMon Cloud Defense Reader followed by a per-subscription suffix | The built-in Reader role's */read plus Microsoft.Web/sites/config/list/action |
| A role assignment of that role to the identity, scoped to the subscription | Lets Cloud Defense read the subscription |
Verify it landed
| What to check | Where to look |
|---|---|
| Cloud Defense can sign in | The Provision page shows This account has been provisioned. and no Resource Errors |
| The account has no discovery errors | Settings > Cloud Accounts: no red warning icon on the account's row |
| The resources themselves | Inventory, filtered by the account. Supported resources lists what discovery covers |
| Findings | Posture Monitoring, after the first checks run |
| What was created in Azure | Portal: resource group FireMonCloudDefense containing the identity, and under Subscriptions > Access control (IAM) > Role assignments, the FireMon Cloud Defense Reader role assigned to it |
Add every subscription in a tenant at once
When one identity can read many subscriptions, you don't have to add them one at a time.
- Run the provisioning command above in one subscription, so the identity and its role exist.
- Give that identity read access to each other subscription you want monitored: assign it the built-in Reader role on the subscription, or on a management group that contains the subscriptions. The FireMon Cloud Defense Reader role adds one read action on top of Reader, for web app configuration.
- In Cloud Defense, go to Settings > Cloud Accounts and choose Add Multiple Azure Accounts from the menu next to Add Cloud Account. Enter the Azure Tenant ID and the identity's Managed Identity Client ID.
- Either list the subscriptions yourself, as a table or as CSV lines of
Subscription Name,Subscription ID, or leave the list empty and Cloud Defense adds every subscription the identity can access. Rows without a subscription ID are ignored, and a row without a name uses the ID as its name. - Save. Cloud Defense creates a Read Only account for each subscription, already provisioned with the shared identity, and updates any account that already existed for one of them.
After that, the same page shows the tenant's subscriptions: how many are onboarded, how many are on the deny list, and one row per subscription with its account name, project, and status. Tick Deny for a subscription you don't want monitored and save; its account is removed and not recreated. Both lists can be downloaded as CSV. Deleting the Azure setup from this page stops the daily check but leaves the individual accounts in place.
Cloud Defense re-lists the tenant's subscriptions once a day. A new subscription the identity can access gets an account automatically. A subscription that stops appearing is flagged in the Status column, and its account is removed after it has been missing from three daily checks in a row.
Azure documentation
- Deployment stacks: the
az stack sub createcommand the provisioning step uses - Federated identity credentials for a user-assigned managed identity: how Cloud Defense signs in without a secret
- Azure custom roles: the role the command creates
Supported resources
Discovery covers the Azure resource types below. The ID column is the type each resource is listed under in Inventory.
Show all 40 resource types
| Name | ID |
|---|---|
| Activity Log Alert | Microsoft.Insights.ActivityLogAlerts |
| AFD WAF Policy | Microsoft.Network.frontdoorWebApplicationFirewallPolicies |
| Application Gateway | Microsoft.Network.applicationGateways |
| Application Insights | Microsoft.Insights.Components |
| Bastion Host | Microsoft.Network.Bastion |
| CosmosDB Account | Microsoft.DocumentDB.databaseAccounts.accounts |
| Disk | Microsoft.Compute.Disks |
| DNS Zone | Microsoft.Network.dnszones |
| DNS Zone Record Set | Microsoft.Network.dnszones.recordsets |
| Front Door CDN Profile | Microsoft.Cdn.profiles |
| Key Vault | Microsoft.KeyVault.vaults |
| Key Vault Key | Microsoft.KeyVault.vaults.keys |
| Key Vault Secret | Microsoft.KeyVault.vaults.secrets |
| Load Balancer | Microsoft.Network.loadBalancers |
| Managed Identity | Microsoft.ManagedIdentity.userAssignedIdentities |
| MySql Flexible Server | Microsoft.DBforMySQL.flexibleservers.databases |
| MySQL Server | Microsoft.DBforMySQL.servers.databases |
| Network Interface | Microsoft.Network.networkInterfaces |
| Network Security Group | Microsoft.Network.networkSecurityGroups |
| Network Watcher | Microsoft.Network.NetworkWatcher |
| PostgreSQL Server | Microsoft.DBforPostgreSQL.servers.databases |
| Public IP Address | Microsoft.Network.publicIPAddresses |
| Redis Cache | Microsoft.Cache.Redis |
| Role | Microsoft.Authorization.roleDefinitions |
| SQL Database | Microsoft.Sql.servers.databases |
| SQL Server | Microsoft.Sql.servers |
| Storage Account | Microsoft.Storage.storageAccounts |
| Subscription | Custom::Microsoft::Subscription |
| Synapse Workspace | Microsoft.Synapse.workspaces |
| Virtual Hub | Microsoft.Network.virtualHubs |
| Virtual Hub Virtual Network Connection | Microsoft.Network.virtualHubs.hubVirtualNetworkConnections |
| Virtual Machine | Microsoft.Compute.VirtualMachine |
| Virtual Network | Microsoft.Network.virtualNetworks |
| Virtual Network Gateway | Microsoft.Network.virtualNetworkGateways |
| Virtual WAN | Microsoft.Network.virtualWans |
| VPN Server Configuration | Microsoft.Network.vpnServerConfigurations |
| VPN Site | Microsoft.Network.vpnSites |
| Web App | Microsoft.Web.sites |
| Web App Firewall Policy | Microsoft.Network.applicationGatewayWebApplicationFirewallPolicies |
| Web App Slot | Microsoft.Web.sites.slots |