Configuring Azure and Microsoft Entra ID

To display your Azure resources and the access tied to them, you must first create policies and permissions in your cloud environment that allow CIEM to report on cloud access data.

Use an Azure account with administrative privileges to:

Register CIEM as a new application with Microsoft Entra ID (formerly Azure AD).
Grant permissions to read your Microsoft Entra ID policies and resource inventories.
Create a client secret to use when registering your source with CIEM.

When you have completed your Microsoft Entra ID configuration, you will connect your cloud source data to CIEM and IdentityNow.

Registering CIEM with Microsoft Entra ID

You must first register CIEM as an application with Microsoft Entra ID.

Sign in to the Azure Cloud portal and select Microsoft Entra ID.
Copy the tenant ID and save it somewhere accessible, as you'll need this information to connect the Azure cloud source to CIEM.
Select App registrations in the left sidebar and select New registration.
Enter a name for the new application, such as "SailPoint CIEM".
Under Supported account types, keep the default of allowing a single tenant to ensure that only accounts in the organizational directory can access this application.
Select Register to register CIEM with Microsoft Entra ID.
Copy the Application (client) ID that's generated, as you'll need this information to connect the cloud source with CIEM.

Granting Read Permissions to CIEM

After you’ve registered CIEM with Microsoft Entra ID, you must grant it the permissions required to read the security policies configured for the Azure source and the resources inventory.

Setting Up the Global Admin Role

You must create a global admin role that can manage access at the root management group level. All subscriptions will inherit the custom role from their management group.

To set up the global admin role:

Select Properties in Microsoft Entra ID.
Set the toggle for Access management for Azure resources to Yes.
Select Save.

This will allow you to manage access to all Azure subscriptions and management groups in the tenant.

Enabling Read Access to Microsoft Azure

You must enable the Directory.Read.All setting so that CIEM can read the Microsoft Azure inventory.

Select App registrations in Microsoft Entra ID.
Select the CIEM app you registered earlier.
Select API permissions in the left sidebar and choose Add a permission.
Select Microsoft Graph.
Select Application permissions and expand the Directory category.
Select Directory.Read.All to allow CIEM to read directory data on your Microsoft Azure source.
Expand the Role Management category and select RoleManagement.Read.Directory to allow CIEM to read all directory role-based access control settings for the source.
If you use Privileged Access Management (PIM) for groups, search for "privileged" in the Select permissions search bar. Select the following API permissions so CIEM can include potential Azure cloud resource access derived from eligible membership in PIM groups:
- PrivilegedAccess.Read.AzureADGroup
- PrivilegedAssignmentSchedule.Read.AzureADGroup
- PrivilegedEligibilitySchedule.Read.AzureADGroup
Note

PIM group information is only applicable for CIEM. Identity Security Cloud does not support PIM groups.
Select Add permissions and Grant admin consent to specify what the SailPoint app can request and to confirm the app is approved to make requests.

Creating Strict Custom Roles

Next, you will create custom roles in Microsoft Entra ID with the minimum permissions required to allow CIEM to read your Microsoft Entra ID data.

Select Management groups in Microsoft Entra ID.
Select the root management group to add the role to. The role will inherit the group’s subscriptions.
In the sidebar, select Access control (IAM).
Select Add and choose Add custom role from the dropdown menu.
On the Basics tab, enter a custom role name, such as Resource Reader.
Select the JSON tab.

Select the Edit button. Enter the following JSON schema, replacing the managementGroups ID with your own.

Display required permissions

{
    "properties": {
        "roleName": "Resource Reader",
        "description": "View strict list of resources, doesn't allow you to make any changes.",
        "assignableScopes": [
            "/providers/Microsoft.Management/managementGroups/aaaaaaa-9999-1234-5678-d1dd0000c000 (1)"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.ApiManagement/service/groups/users/read",
                    "Microsoft.ApiManagement/service/subscriptions/read",
                    "Microsoft.ApiManagement/service/users/groups/read",
                    "Microsoft.Authorization/*/read",
                    "Microsoft.Cache/redis/read",
                    "Microsoft.ClassicCompute/virtualMachines/read",
                    "Microsoft.ClassicNetwork/networkSecurityGroups/read",
                    "Microsoft.ClassicNetwork/virtualNetworks/read",
                    "Microsoft.Compute/disks/read",
                    "Microsoft.Compute/virtualMachines/read",
                    "Microsoft.DBforMariaDB/servers/databases/read",
                    "Microsoft.DBforMySQL/servers/databases/read",
                    "Microsoft.DBforPostgreSQL/servers/databases/read",
                    "Microsoft.DocumentDB/databaseAccounts/read",
                    "Microsoft.Insights/ActivityLogAlerts/Read",
                    "Microsoft.Insights/eventtypes/values/Read",
                    "Microsoft.Insights/LogProfiles/Read",
                    "Microsoft.KeyVault/vaults/keys/read",
                    "Microsoft.KeyVault/vaults/providers/Microsoft.Insights/diagnosticSettings/Read",
                    "Microsoft.KeyVault/vaults/read",
                    "Microsoft.KeyVault/vaults/secrets/read",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/listAssociatedResources/action",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
                    "Microsoft.Network/loadBalancers/read",
                    "Microsoft.Network/networkInterfaces/read",
                    "Microsoft.Network/networkSecurityGroups/read",
                    "Microsoft.Network/networkWatchers/queryFlowLogStatus/action",
                    "Microsoft.Network/networkWatchers/read",
                    "Microsoft.Network/routeTables/read",
                    "Microsoft.Network/virtualNetworks/read",
                    "Microsoft.Network/virtualNetworks/subnets/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                    "Microsoft.Resources/subscriptions/resources/read",
                    "Microsoft.Resources/tenants/read",
                    "Microsoft.Security/autoProvisioningSettings/read",
                    "Microsoft.Security/pricings/read",
                    "Microsoft.Security/securityContacts/read",
                    "Microsoft.Sql/managedInstances/administrators/read",
                    "Microsoft.Sql/managedInstances/databases/read",
                    "Microsoft.Sql/servers/administrators/read",
                    "Microsoft.Sql/servers/databases/auditingSettings/read",
                    "Microsoft.Sql/servers/databases/read",
                    "Microsoft.Sql/servers/databases/securityAlertPolicies/read",
                    "Microsoft.Sql/servers/failoverGroups/read",
                    "Microsoft.Sql/servers/firewallRules/read",
                    "Microsoft.Sql/servers/keys/read",
                    "Microsoft.Sql/servers/read",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
                    "Microsoft.Storage/storageAccounts/read",
                    "Microsoft.Web/sites/Read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Replace the managementGroups ID with your own

Select Save to update the JSON schema and Review + create.
Select Create to create the custom role.

Privileged Access Management

If you have an Microsoft Entra ID Privileged Identity Management Premium P2 license, CIEM will display access users have to Azure resources from their PIM eligible assignments.

You will now assign this role to the app.

Assigning Roles to App Registration

You must now assign the role you created to the App Registration.

Select Management groups in the Microsoft Entra ID portal.
Select the root group name and select Access control (IAM) from the left sidebar.
Select Add and choose Add role assignment from the dropdown menu.
In the role section, search for and select the custom role you created earlier. Select Next.
In the Members tab, select the radio button next to User, group, or service principal.
Select Select members. Search for and select the application you registered.
Confirm your selection using the Select button.
Select Review + Assign to assign the role to CIEM.

Creating a Client Secret for CIEM

To finish registering your Microsoft Entra ID accounts, you'll need to create a client secret for CIEM.

Select App registrations in Microsoft Entra ID and choose the application you named earlier.
Select Certificates & secrets.
Under Client secrets, select + New client secret and add a description and expiration date.

Best Practice

Set an expiration date of 6 months.
Select Add.

Save the Value and Secret ID in a safe place. You will enter the client secret in the Client Secret field when you connect to IdentityNow.