Azure

Adding an Azure subscription does two things:

• Inventory discovery reads the subscription's resources into Inventory and keeps them current with a daily discovery.
• Group export, optionally, pushes a Connect Group to the subscription as an Azure IP Group, kept in sync automatically, so you can reference it in Azure Firewall policy rules.

Connect signs in to the subscription as a user-assigned managed identity you create, through a federated credential. No client secret is created or stored anywhere.

Before you start

Prerequisite	Why it's needed	Where to check
The subscription ID (a GUID)	It identifies the subscription in Connect	Azure portal: Subscriptions
Permission to create a subscription-scoped deployment, including a custom role definition and a role assignment (Owner, or User Access Administrator plus Contributor)	The provisioning command creates a resource group, an identity, a custom role, and assigns it	Subscriptions > your subscription > Access control (IAM)
Azure CLI, or Azure Cloud Shell, signed in to the tenant	The command uses az stack sub create	Cloud Shell has the CLI preinstalled
For Group export, the Azure region to create IP Groups in	IP Groups are regional resources	Your choice; the firewall's region is the usual pick

Set up an Azure account

1. In Connect, go to Settings > Accounts and add a new account.
2. Cloud Provider: Azure. Enter the Azure Subscription ID, a name, and a project.
3. Under Connect Access, choose Read Only for inventory alone, or Read & Write if you want to export Groups to this subscription as IP Groups. This choice is permanent. It sets which permissions the provisioning command grants and can't be changed later; to add export to a Read Only account, create a new account. If no Connect Access choice is shown, contact FireMon Support.
4. Save. You land on the Provision page. Copy the Azure CLI command shown there and run it in Cloud Shell or a terminal signed in to your tenant. It downloads two Bicep files and creates a deployment stack named FireMonCloudDefenseStack in the subscription. The --location westus2 in the command is where the FireMonCloudDefense resource group and identity are created; change it if you prefer another region.
5. The command prints a Tenant ID and a Client ID. Back on the Provision page, enter both, and if you chose Read & Write, enter the Default Region for exported IP Groups (for example eastus). Save. You see This account has been successfully updated. and the first discovery starts on its own.

What the command creates

Resource	Purpose
Resource group FireMonCloudDefense	Holds the identity
User-assigned managed identity FireMonCloudDefenseIdentity, with a federated credential named CloudDefense	The identity Connect signs in as. Its federated credential trusts Connect's identity provider for your client only
A custom role, FireMon Cloud Defense Reader (or Contributor) followed by a per-subscription suffix	Reader grants */read plus Microsoft.Web/sites/config/list/action. Contributor adds Microsoft.Network/ipGroups/write and delete, and Microsoft.Resources/subscriptions/resourceGroups/write, and nothing else
A role assignment of that role to the identity, scoped to the subscription	Lets Connect read the subscription (and, with Contributor, manage IP Groups)

Verify it landed

What to check	Where to look
Connect can sign in	The Provision page shows This account has been provisioned. and no Resource Errors
The account has no discovery errors	Settings > Accounts: no warning icon on the Azure account
The resources themselves	Inventory > Resources, filtered by Vendor > Azure. The supported Azure resource types page lists what discovery covers
What was created in Azure	Portal: resource group FireMonCloudDefense containing the identity, and under Subscriptions > Access control (IAM) > Role assignments, the FireMon Cloud Defense Reader or Contributor role assigned to it

Export a Group as an IP Group

The account must have been created with Read & Write, and its Default Region must be set.

1. In Connect, go to Groups > New Group (or edit an existing one).
2. Set Update to Automatic so membership stays current with no manual refresh.
3. Pick the Project.
4. Under Export To, select your Azure account.
5. Build the membership filters and confirm the preview under Group Candidates shows what you expect.
6. Save. The warning that saving exports all current matches to the targets above is expected.

Update and Project are fixed once the Group exists; see What a Connect Group is. Membership caps at 10,000 items; see Group size limits. The 5,000-entry IP Group limit below is stricter.

The export runs shortly after each save and each membership update. Check the result in Azure.

What Connect creates in Azure

Resource	Details
Resource group Connect-Groups, in the account's Default Region	Created on the first export if it doesn't exist. All IP Groups go here
One IP Group per exported Group	Named after your Group with unsupported characters replaced by hyphens, truncated to fit 80 characters, and the last 8 characters of the Group's ID appended, so Blocked Ranges becomes something like Blocked-Ranges-Q69G5FAV. Tagged managedBy: connect

Every export replaces the IP Group's entire address list with the Group's current members. IPv4 addresses, CIDRs, and hyphenated ranges are exported; IPv6 members are left out, because Azure IP Groups don't accept them.

Verify it landed

In the Azure portal, open IP Groups (or the Connect-Groups resource group) and select the group named after your Connect Group. Its IP addresses should match the Group's IPv4 members. To find everything Connect manages, filter resources on the tag managedBy : connect.

Use the IP Group in your policy

Reference the IP Group as a source or destination in a rule of your Azure Firewall policy (choose IP Group as the source or destination type). Until you do, it has no effect on traffic. The IP Group keeps its identity across exports, so the reference survives membership changes.

How changes are handled

Action	Result
Edit the Group's filters, or a resource gains or loses a matching tag	The IP Group's address list is replaced on the next export.
Rename the Group	The IP Group follows the Group's name, so a rename creates a new IP Group under the new name. The old one is deliberately left in place so that any rule still referencing it keeps working; it just stops receiving updates. Repoint those rules at the new IP Group, then delete the old one in Azure.
Remove the Azure account from Export To	The IP Group is deleted from Azure.
Delete the Group	The IP Group is deleted from Azure. Unlike the Panorama and NSX exports, the Azure export does clean up after itself.
Edit the IP Group's addresses or tags in Azure	Overwritten on the next export.

Azure refuses to delete an IP Group that a firewall policy still references. If a rule still uses the IP Group when its Group is deleted or un-targeted, the delete fails. Connect retries it for a few minutes and then stops, so remove the rule's reference first; if the IP Group is still there afterward, delete it in Azure.

Details and edge cases

The IP Group limit is 5,000 entries, counting each address, CIDR, or range as one. Connect deliberately exports nothing for a Group over that limit rather than a truncated list: Azure replaces the whole address set in one call, and a partial IP Group would look complete while enforcing only a fraction of the Group. Any IP Group already exported for that Group is left exactly as it was. Keep each exported Group under the limit, splitting it into narrower Groups where needed. The Groups page doesn't show export status, so after enlarging a Group, confirm the IP Group in Azure picked up the change; one that has stopped updating has usually crossed the limit.

Inventory and export use the same identity. A permissions problem shows up in both: as Resource Errors on the Provision page for discovery, and as an IP Group that never appears for export. Confirm the role assignment exists under the subscription's Access control (IAM).

For common issues, see Troubleshooting.

Azure documentation

• IP Groups in Azure Firewall: what an IP Group is, its limits, and how to reference one in a rule
• Deployment stacks: the az stack sub create command the provisioning step uses
• Federated identity credentials for a user-assigned managed identity: how Connect signs in without a secret
• Azure custom roles: the role the command creates