Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RLP-153443, PCSUP-24945 CSPM Azure Doc Update - Microsoft Entra ID #774

Merged
merged 4 commits into from
Dec 10, 2024
Merged

RLP-153443, PCSUP-24945 CSPM Azure Doc Update - Microsoft Entra ID #774

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
49db888
Azure Account Onboarding guide, Replace Azure Active directory with M…
jrdevore Nov 18, 2024
70cc2a2
remove admonition
jrdevore Nov 18, 2024
ae0828d
Merge branch 'master' into RLP-153443-azure-entra
jrdevore Dec 4, 2024
dc592c7
Merge branch 'master' into RLP-153443-azure-entra
jrdevore Dec 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 24 additions & 25 deletions products/prisma-cloud/docs/cspm/azure-account-onboarding.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,11 +4,10 @@ title: Automate Azure Cloud Account Onboarding
sidebar_position: 4
---

Onboarding an Azure account, such as Azure Tenant, Azure Subscription, or Azure Active Directory on Prisma Cloud connects all your Azure resources to Prisma Cloud including Accounts with Management Groups, Subscriptions, and Active Directory. Prisma Cloud uses Application (Client) ID, Application Client Secret and Enterprise Application Object ID for authentication to ingest Azure Active Directory metadata, configurations, and logs.
Onboarding an Azure account, such as Azure Tenant, Azure Subscription, or Microsoft Entra ID _(previously known as Azure Active Directory)_ on Prisma Cloud connects all your Azure resources to Prisma Cloud including Accounts with Management Groups, Subscriptions, and Microsoft Entra. Prisma Cloud uses Application (Client) ID, Application Client Secret and Enterprise Application Object ID for authentication to ingest Microsoft Entra ID metadata, configurations, and logs.


> **Prerequisite**:
> - Obtain a [Prisma Cloud API authorization token](/prisma-cloud/api/cspm/app-login/) ![alt text](/icons/api-icon-pan-dev.svg), which will be used in all the APIs.
> **Prerequisite**:
> - Obtain a [Prisma Cloud API authorization token](/prisma-cloud/api/cspm/app-login/) ![alt text](/icons/api-icon-pan-dev.svg), which will be used in all the APIs.

:::info

Expand All @@ -17,12 +16,12 @@ Onboarding an Azure account, such as Azure Tenant, Azure Subscription, or Azure

:::

To onboard Azure Accounts, such as Subscription, Tenant, and Active Directory:
To onboard Azure Accounts, such as Subscription, Tenant, and Microsoft Entra ID:

[1. Fetch the supported features based on the cloud type, account type, and deployment type.](#1-fetch-the-supported-features)

[2. Generate the Terraform template.](#2-generate-the-terraform-template)

[3. Execute the Terraform template in Azure Portal to Register an application and create its roles and permissions.](#3-register-an-application-and-create-corresponding-roles-in-the-azure-portal)

[4. Onboard your Azure Account on Prisma Cloud ](#4-onboard-the-azure-tenant-on-prisma-cloud)
Expand All @@ -35,7 +34,7 @@ Get the list of supported features based on the cloud type, account type, and de

> **NOTE:** By default, the supported features list contains **Cloud Visibility Compliance and Governance**. Do not include it as a feature in the supported feature request body parameter of any cloud APIs, such as Add Azure Cloud Account, Update Azure Cloud Account, Azure Template Generation and so on.

**Sample Request and Response for Azure Subscription**
**Sample Request and Response for Azure Subscription**

<details>
<summary>Sample Request</summary>
Expand Down Expand Up @@ -72,7 +71,7 @@ Get the list of supported features based on the cloud type, account type, and de
```
</details>

**Sample Request and Response for Azure Tenant**
**Sample Request and Response for Azure Tenant**

<details>
<summary>Sample Request</summary>
Expand Down Expand Up @@ -110,7 +109,7 @@ Get the list of supported features based on the cloud type, account type, and de
```
</details>

**Sample Request and Response for Azure Active Directory Account**
**Sample Request and Response for Microsoft Entra Account**

<details>
<summary>Sample Request</summary>
Expand Down Expand Up @@ -144,18 +143,18 @@ Get the list of supported features based on the cloud type, account type, and de
```
</details>



## 2. Generate the Terraform Template

Generate the Azure Terraform Template by using the [Generate and Download the Azure Terraform template API](/prisma-cloud/api/cspm/generate-template-link/) ![alt text](/icons/api-icon-pan-dev.svg). The terraform template will include the necessary roles and custom role actions based on the selected features.

Save the generated json response and name the file as `terraform.tf.json`. You can create a directory for each Terraform template that you have download. This allows you to manage multiple templates if you add a different Azure Tenant to Prisma Cloud and update existing roles.
Save the generated json response and name the file as `terraform.tf.json`. You can create a directory for each Terraform template that you have download. This allows you to manage multiple templates if you add a different Azure Tenant to Prisma Cloud and update existing roles.

> **NOTE**: `Azure China` does not support the use of Terraform templates. You can either create a custom role to authorize Prisma Cloud access or manually authorize Prisma Cloud.


**Sample Request and Response for Azure Subscription**
**Sample Request and Response for Azure Subscription**

<details>
<summary>Sample Request</summary>
Expand Down Expand Up @@ -361,9 +360,9 @@ Save the generated json response and name the file as `terraform.tf.json`. You c
```

</details>


**Sample Request and Response for Azure Tenant**

**Sample Request and Response for Azure Tenant**
<details>
<summary>Sample Request</summary>

Expand Down Expand Up @@ -607,7 +606,7 @@ Save the generated json response and name the file as `terraform.tf.json`. You c
"Microsoft.Sql/servers/databases/read",
"Microsoft.Sql/servers/databases/securityAlertPolicies/read",
"Microsoft.Sql/servers/databases/transparentDataEncryption/read"

],
"type": "list"
},
Expand All @@ -633,7 +632,7 @@ Save the generated json response and name the file as `terraform.tf.json`. You c

</details>

**Sample Request and Response for Azure Active Directory**
**Sample Request and Response for Microsoft Entra ID**
<details>
<summary>Sample Request</summary>

Expand Down Expand Up @@ -774,8 +773,8 @@ Save the generated json response and name the file as `terraform.tf.json`. You c
```

</details>



## 3. Register an Application and Create Corresponding Roles in the Azure Portal

Expand All @@ -788,16 +787,16 @@ Add Azure Account by using [Add Azure Account API](/prisma-cloud/api/cspm/add-az

Provide the details for the Add Azure Account API Parameters according to the following mapping:

Add Azure Account API Parameters | Terraform Template Keys
-------------------------------- | -----------------------
clientId | b_application_id
Add Azure Account API Parameters | Terraform Template Keys
-------------------------------- | -----------------------
clientId | b_application_id
key | c_application_key
servicePrincipalId | e_service_principal_object_id

> **Note:** By default, the supported features list will contain **Cloud Visibility Compliance and Governance**. Do not include it as a feature in the supported feature request body parameter. An empty features list indicates that the default capabilities under **Cloud Visibility Compliance and Governance** are enabled.

<details>
<summary>Sample Request for Azure Subscription</summary>
<summary>Sample Request for Azure Subscription</summary>

```bash
curl -v --request POST 'https://api.prismacloud.io/cas/v1/azure_account' \
Expand Down Expand Up @@ -843,7 +842,7 @@ curl -v --request POST 'https://api.prismacloud.io/cas/v1/azure_account' \
</details>

<details>
<summary>Sample Request for Azure Tenant</summary>
<summary>Sample Request for Azure Tenant</summary>

```bash
curl -v --request POST 'https://api.prismacloud.io/cas/v1/azure_account' \
Expand Down Expand Up @@ -900,7 +899,7 @@ curl -v --request POST 'https://api.prismacloud.io/cas/v1/azure_account' \
</details>

<details>
<summary>Sample Request for Azure Active Directory</summary>
<summary>Sample Request for Microsoft Entra ID</summary>

```bash
curl -v --request POST 'https://api.prismacloud.io/cas/v1/azure_account' \
Expand Down
Loading