Set up the Microsoft Azure connector

This guide provides the information you need to deploy Veracode Risk Manager (VRM) for your Azure cloud infrastructure. Once you have gathered the appropriate information, it should take only a few minutes to set up the connector and initiate the data ingestion process.

The VRM setup process includes these tasks:

1. Have the required permissions
2. Create a service principal for VRM
3. Provide the required permissions to access Microsoft Graph API
4. Provide the required permissions to access Resource Graph API
5. Create a secret for the application registration
6. Connect to Azure environment and define integration settings

Azure requirements

You must have Global Administrator permissions in your Azure environment.

Create a Service Principal for VRM

VRM gathers data from your Azure tenant using an enterprise application backed by an app registered in your Azure tenant. VRM uses application secret authentication. The service principal allows VRM to read Azure data from a wide variety of services.

To complete this task:

Follow the Microsoft instructions on how to provision an app registration and create a service principal. However, when creating a new registration, under Supported account types, select Account in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).

Provide the required permissions for the VRM Service Principal to access Microsoft Graph API

Once you have created an app registration, you must grant Microsoft Graph API permissions to it so VRM can read data from Azure.

To complete this task:

1. In Microsoft Entra, from the App registrations page, select the app registration you created in the previous section.
2. Select API Permissions > Add a permission > Microsoft Graph > Applications permissions.
3. Ensure the app registration has the following permissions:
   • Application.Read.All — provides access to the application used for SSO.
   • AuditLog.Read.All — allows VRM to read and query your audit log activities without a signed-in user.
   • DeviceManagementManagedDevices.Read.All — allows VRM to read the properties of devices managed by Microsoft Intune.
   • Directory.Read.All — provides read access to read data in your organization's directory, such as users, groups, and apps.
   • Group.Read.All — provides the list of groups used for SSO.
   • GroupMember.Read.All — provides the list of users for the groups above.
   • Policy.Read.All — provides read access to read your organization's policies.
   • SecurityEvents.Read.All — provides read access to all security events across the tenant.
   • UserAuthenticationMethod.Read.All — allows VRM to read users authentication methods.
4. To provide consent to the application for the permissions to take effect, a tenant administrator must open the corresponding enterprise application object and select Permissions > Grant Admin Consent.

NOTE: You can selectively omit permissions, although doing so causes VRM to function in a reduced capacity. If you want to edit the permission, reach out to your VRM customer success contact.

Provide the required permissions for the VRM service principal to access the Resource Graph API

Your application must have access to the Azure Resource Graph API to read context about Azure assets. This requires that your application be assigned the Reader role in Azure.

You can assign this role at three levels:

• A management group that has access to all subscriptions that you want to onboard to VRM
• The tenant root group
• Individual subscriptions

Assign permissions at management group level

To complete this task:

1. In the Azure portal, search for management groups and select the management group to which you want to assign permissions.
2. Select Access Control (IAM) > Add > Add role assignment.
   
3. Under Role, select Reader, and then select Next.
4. Select + Select Members.
5. Select the VRM service principal you created, and then select Select.
6. Select Review + assign.
7. Review the output to make sure the settings are correct, and then select Review + assign.
8. Repeat these steps to add the Storage Blob Data Reader role. This access is only used to read Terraform State Files stored in Azure blob storage.

Assign permissions at tenant root group level

If you do not have a management group with access to all desired subscriptions, you can assign permissions at the tenant root group level, which covers all subscriptions within the tenant.

These instructions use Microsoft user interfaces, which require your user account to have the proper permissions to change role assignments at the tenant root management group level.

To assign permissions using PowerShell, follow the Microsoft documentation.

To complete this task:

1. In Microsoft Entra, search for and then select Tenant properties.
2. Under Access management for Azure resources, select Yes.
3. Select Save.
4. In the Azure portal, search for management groups and select the tenant root group.
5. From the tenant group, select Access Control (IAM) > Add > Add role assignment.
6. Under Role, select Reader, and then select Next.
7. Select + Select Members.
8. Select the VRM service principal you created, and then select Select.
9. Select Review + assign.
10. Review the output to make sure the settings are correct, and then select Review + assign.
11. Repeat these steps to add the Storage Blob Data Reader role.

Assign permissions at individual subscription level

In some cases, you cannot assign the Reader role to VRM at the management group or tenant root group level. If this is your situation, you can assign permissions for each individual subscription that you want to deliver data to VRM.

To complete this task:

1. In the Azure portal, select Subscriptions and select the relevant subscription.
2. Select Access Control (IAM) > Add > Add role assignment
3. Under Role, select Reader, and then select Next.
4. Select + Select Members.
5. Select the VRM service principal you created, and then select Select.
6. Select Review + assign.
7. Review the output to make sure the settings are correct, and then select Review + Assign.
8. Repeat these steps to add the Storage Blob Data Reader role.

Create a secret for the application registration

1. In the Azure portal, open the application you created as the service principal.
2. Select Manage > Certificates & secrets from the left menu.
3. Select New client secret.
4. Enter a description and set the expiration date based on your company policy. Veracode recommends 12 months.
5. Select Add.
6. On the Overview page, copy the Directory (tenant) ID and the Application (client) ID to a secure location.
7. On the Certificates & secrets page, copy the client secret from the Value column to a secure location.

In VRM, the copied values have the following mapping:

Azure name	VRM name
Directory (tenant) ID	Tenant ID
Application (client) ID	Client ID
Value (in client secret table)	Client secret

Connect VRM to your Azure environment

After completing the setup tasks in Azure, you can set up your Microsoft Azure connector in VRM.

To complete this task:

1. In VRM, from the left navigation menu, select the Settings icon .
2. Select Add Connector.
3. Select the Microsoft Azure tile.
4. Paste the tenant ID, client ID, and client secret that you saved when creating the secret for your application registration.
5. Select Continue.
6. Select the specific subscriptions you want to add to VRM or select all subscriptions.
7. On the Integration Settings page, enter a name for the connector.
8. Optionally, select an account value, which helps VRM understand the relative importance of this account in your organization.
9. Optionally, select the regions that you want VRM to access and monitor.
10. Select Continue.
11. On the remaining pages, you can perform the optional setup configurations that enhance VRM’s security analysis by leveraging your existing tagging schema. If you want to edit these settings later, select your Azure connector from the Connectors page, and select Actions > Manage Connector.
12. After configuring your connector, select View Prioritized Issues to review issues in your environment.