Configuring Azure Active Directory

To display your Azure Active Directory (AD) resources and the access tied to them, you must first create policies and permissions in your cloud environment that allow CIEM to report on cloud access data.

Use an Azure account with administrative privileges to:

Register CIEM as a new application with Azure AD.
Grant permissions to read your Azure AD policies and resources inventory.
Create a client secret to use when registering your source with CIEM.

When you have completed your Azure AD configuration, you will connect your cloud source data to CIEM and IdentityNow.

Registering CIEM With Azure AD

You must first register CIEM as an application with Azure AD.

Sign in to the Azure Cloud portal and select Azure Active Directory.
Copy the tenant ID and save it somewhere accessible, as you'll need this information to connect the Azure AD cloud source with CIEM.
Select App registrations in the left sidebar and select New registration.
Enter an appropriate name for the new application, such as "SailPoint CIEM".
Under Supported account types, keep the default of allowing a single tenant to ensure that only accounts in the organizational directory can access this application.
Select Register to register CIEM with Azure AD.
Copy the Application (client) ID that's generated, as you'll need this information to connect the cloud source with CIEM.

Granting Read Permissions to CIEM

After you’ve registered CIEM with Azure AD, you must grant it the permissions required to read the security policies configured for the Azure source and the resources inventory.

Setting Up the Global Admin Role

You must create a global admin role that can manage access at the root management group level. All subscriptions will inherit the custom role from their management group.

To set up the global admin role:

Select Properties in Azure Active Directory.
Set the toggle for Access management for Azure resources to Yes.
Select Save.

This will allow you to manage access to all Azure subscriptions and management groups in the tenant.

Enabling Read Access to Microsoft Azure

You must enable the Directory.Read.All setting so that CIEM can read the Microsoft Azure inventory.

Select App registrations in Azure Active Directory.
Select the CIEM app you registered earlier
Select API permissions in the left sidebar and choose Add a permission.
Select Microsoft Graph.
Select Application permissions and expand the Directory category.
Select Directory.Read.All to allow CIEM to read directory data on your Microsoft Azure source.
Expand the Role Management category and select RoleManagement.Read.Directory to allow CIEM to read all directory role-based access control settings for the source.
Select Add permissions and Grant admin consent to specify what the SailPoint app can request and to confirm the app is approved to make requests.

Creating Strict Custom Roles

Next, you will create custom roles in Azure AD with the minimum permissions required to allow CIEM to read your Azure AD data.

Select Management groups in Azure Active Directory.
Select the root management group to add the role to. The role will inherit the group’s subscriptions.
In the sidebar, select Access control (IAM).
Select Add and choose Add custom role from the dropdown menu.
On the Basics tab, enter a custom role name, such as Resource Reader.
Select the JSON tab.

Select the Edit button. Enter the following JSON schema, replacing the managementGroups ID with your own.

Display required permissions

{
    "properties": {
        "roleName": "Resource Reader",
        "description": "View strict list of resources, doesn't allow you to make any changes.",
        "assignableScopes": [
            "/providers/Microsoft.Management/managementGroups/aaaaaaa-9999-1234-5678-d1dd0000c000 (1)"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.ApiManagement/service/groups/users/read",
                    "Microsoft.ApiManagement/service/subscriptions/read",
                    "Microsoft.ApiManagement/service/users/groups/read",
                    "Microsoft.Authorization/*/read",
                    "Microsoft.Cache/redis/read",
                    "Microsoft.ClassicCompute/virtualMachines/read",
                    "Microsoft.ClassicNetwork/networkSecurityGroups/read",
                    "Microsoft.ClassicNetwork/virtualNetworks/read",
                    "Microsoft.Compute/disks/read",
                    "Microsoft.Compute/virtualMachines/read",
                    "Microsoft.DBforMariaDB/servers/databases/read",
                    "Microsoft.DBforMySQL/servers/databases/read",
                    "Microsoft.DBforPostgreSQL/servers/databases/read",
                    "Microsoft.DocumentDB/databaseAccounts/read",
                    "Microsoft.Insights/ActivityLogAlerts/Read",
                    "Microsoft.Insights/eventtypes/values/Read",
                    "Microsoft.Insights/LogProfiles/Read",
                    "Microsoft.KeyVault/vaults/keys/read",
                    "Microsoft.KeyVault/vaults/providers/Microsoft.Insights/diagnosticSettings/Read",
                    "Microsoft.KeyVault/vaults/read",
                    "Microsoft.KeyVault/vaults/secrets/read",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/listAssociatedResources/action",
                    "Microsoft.ManagedIdentity/userAssignedIdentities/read",
                    "Microsoft.Network/loadBalancers/read",
                    "Microsoft.Network/networkInterfaces/read",
                    "Microsoft.Network/networkSecurityGroups/read",
                    "Microsoft.Network/networkWatchers/queryFlowLogStatus/action"
                    "Microsoft.Network/networkWatchers/read",
                    "Microsoft.Network/routeTables/read",
                    "Microsoft.Network/virtualNetworks/read",
                    "Microsoft.Network/virtualNetworks/subnets/read",
                    "Microsoft.Resources/subscriptions/resourceGroups/read",
                    "Microsoft.Resources/subscriptions/resources/read",
                    "Microsoft.Security/autoProvisioningSettings/read",
                    "Microsoft.Security/pricings/read",
                    "Microsoft.Security/securityContacts/read",
                    "Microsoft.Sql/managedInstances/administrators/read",
                    "Microsoft.Sql/managedInstances/databases/read",
                    "Microsoft.Sql/servers/administrators/read",
                    "Microsoft.Sql/servers/databases/auditingSettings/read",
                    "Microsoft.Sql/servers/databases/read",
                    "Microsoft.Sql/servers/databases/securityAlertPolicies/read",
                    "Microsoft.Sql/servers/failoverGroups/read",
                    "Microsoft.Sql/servers/firewallRules/read",
                    "Microsoft.Sql/servers/keys/read",
                    "Microsoft.Sql/servers/read",
                    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
                    "Microsoft.Storage/storageAccounts/read",
                    "Microsoft.Web/sites/Read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Replace the managementGroups ID with your own

Select Save to update the JSON schema and Review + create to create the custom role.
In the Select field, search for the application name you registered.
Select Save to assign the custom role to CIEM.

You will use this role to grant access to the management groups tree.

Privileged Identity Management

If you have an Azure AD Privileged Identity Management Premium P2 license, CIEM will display access users have to Azure resources from their PIM eligible assignments.

Granting Access to the Management Groups Tree

Once you have the correct permissions, you must grant access to the entire management groups tree.

Select Management groups in the Azure AD portal.
Select the root group name and select Access control (IAM) from the left sidebar.
Select Add and choose Add role assignment from the dropdown menu.
In the role section, search for and select the custom role you created earlier. Select Next.
In the Members tab, select the radio button next to User, group, or service principal.
Select Select members. Search for and select the application you registered.
Confirm your selection using the Select button.
Select Review + Assign to assign the role to CIEM.

Creating a Client Secret for CIEM

To finish registering your Azure AD accounts, you'll need to create a client secret for CIEM.

Select App registrations in Azure Active Directory and choose the application you named earlier.
Select Certificates & secrets.
Under Client secrets, select + New client secret and add a description and expiration date.

Best Practice

Set an expiration date of 6 months.
Select Add.

Save the Value and Secret ID in a safe place. You will enter the client secret in the Application Secret field when you connect your CIEM Azure source.