Azure Integration

Integrating with Azure

Overview

Azure integration enables you to scan your Azure cloud infrastructure for runtime misconfigurations. Integration with multiple concurrent subscriptions is not supported.

Though it does not require the integration steps below, Jit recommends that you also activate the Scan IaC for Misconfigurations security requirement for complete infrastructure protection.

Prerequisites

The following are required before you can proceed with Azure integration—

  • A subscription to Azure Security.
  • Microsoft Defender.

Steps for integrating with Azure

To integrate Jit with Microsoft Azure—

  1. Create and configure an Azure app using the instructions in Azure app setup.
  2. From the Jit platform, select Secrets in the menu bar under Settings.
  3. Follow the instructions in Secrets to create secrets for your Azure client ID and Azure client secret named azure_client_id, azure_client_secret, and azure_subscription_ids, respectively. You must use these exact names.
Azure secrets example

Azure secrets example

  1. Select Integrations.
  2. Locate the Azure tile and select integrate-as-code. You are taken to the jit-integration.yml file. Add the information below to this file. If the option to integrate as-code is not available, you may need to manually addjit-integration.yml to the repo containing Jit's configuration files.
azure:
  <integration_id>:
    type: azure_account
    name: "<your account name>"
    auth:
      client_id: "${{ jit_secrets.azure_client_id }}"
      client_secret: "${{ jit_secrets.azure_client_secret }}"
    tenant_id: <your Azure tenant ID>
    subscription_id: "${{ jit_secrets.azure_subscription_ids }}"
KeyValue/description
azure:Integration type. Key must be azure:. The Azure integration is nested in this mapping.
<integration_id>:This key is the name you choose for your Azure integration.
type:Enter azure_account as shown in the example.
name:Enter the name of your Azure account.
client_id:Enter exactly as shown in the example. To view this information in the Azure console, navigate to App registrations > (the app you created in step 1) > Overview.
client_secret:Enter exactly as shown in the example.
tenant_id:Enter your Azure tenant ID as shown in the example. To view this information in the Azure console, navigate to App registrations > (the app you created in step 1) > Overview.
subscription_id:Enter your Azure subscription ID as shown in the example. To view this information in the Azure console, select your subscription from the Resources list on the home page, and then select Overview.

Azure app setup

Create an app

  1. From the Microsoft Azure console, select App registrations.
  2. Select New registration.
  3. Enter a Name.
  4. Select Register.

Add API permissions

  1. Select API permissions from the Manage menu.
  2. Select Add a permission.
  3. Select APIs my organization uses and select Windows Azure Active Directory from the list.
  4. Select Delegated permissions and use the collapsing menus and check boxes to select the following--
    • Directory.Read.All
    • Group.Read.All
    • Policy.Read.All
    • User.Read.All
  5. Select Add permissions.
  6. Repeat these steps to add the user_impersonation permission for the Azure Service Management API and the User.Read permission for the Microsoft Graph API.

Create an app role

  1. Select App roles from the Manage menu.
  2. Select Create app role.
  3. Add a Display name, Value, and description. Set Allowed member types to Both. Select the check box to enable this app role.
  4. Select Create.

Create a client secret

  1. Select Certificates & secrets from the Manage menu.
  2. Select New client secret.
  3. Enter a Description and Expiration.
  4. Select Add. The secret value displays on the Certificates & secrets page. Please note this value, as this is your only opportunity to view this information and you will need it later in the Azure integration process.

Assign the app role to your subscription

  1. From the Microsoft Azure console, select your subscription from the Resources list.
  2. Select Overview and note the subscription ID. You will need it later in the integration process.
  3. Select Access control (IAM) and select Add.
  4. Use the search bar to locate the job function role you created previously and select it.
  5. Select the Members tab and select Select members.
  6. Select your app.
  7. Select Review + assign.