Azure

Experienced with Azure? Here’s a quick summary to get started:

1. Create App Registration
2. Add Permissions for various services:
   • AuditLog: AuditLog.Read.All (Read all audit log data)
   • DeviceManagementConfiguration: DeviceManagementConfiguration.Read.All (Read Microsoft Intune device configurations and policies)
   • DeviceManagementManagedDevices: DeviceManagementManagedDevices.Read.All (Read Microsoft Intune devices)
   • Directory: Directory.Read.All (Read Azure AD data)
   • Reports: Reports.Read.All (Read all usage reports)
   • AdvancedQuery: AdvancedQuery.Read.All (365 Defender)
   • Machine: Machine.Read.All (365 Defender)
3. Grant Permissions to the subscriptions you want to inventory.

---

Detailed Setup Guide for Adding Azure RM to vScope

To inventory Azure Resource Manager (Azure RM), vScope needs read permissions for your subscriptions. This guide walks through creating an app in Azure, generating a key, and configuring Azure RM credentials in vScope.

Prerequisite: Ensure you have permissions to set up applications in Azure. Learn more about roles and permissions here.

---

Create an Application Registration

1.1 Log in to Azure Resource Manager, search for App registrations, and select it.

1.2 Click + New registration to create the vScope application.

1.3 Name the application (e.g., vScope), choose Accounts in this organizational directory only, and click Register.

---

Add API Permissions for Microsoft Graph

2.1 In the API Permissions section, click + Add a permission.

2.2 Under Microsoft APIs, select Microsoft Graph.

2.3 Select Application permissions.

2.4 Choose the following permissions and click Add permissions:

• AuditLog: AuditLog.Read.All (Read all audit log data)
• DeviceManagementConfiguration: DeviceManagementConfiguration.Read.All (Read Microsoft Intune device configurations and policies)
• DeviceManagementManagedDevices: DeviceManagementManagedDevices.Read.All (Read Microsoft Intune devices)
• Directory: Directory.Read.All (Read Azure AD data)
• Reports: Reports.Read.All (Read all usage reports)
• AdvancedQuery: AdvancedQuery.Read.All (365 Defender)
• Machine: Machine.Read.All (365 Defender)

2.5 Grant these permissions by clicking Grant admin consent.

---

Add API Permissions for Defender

3.1 Click + Add a permission again.

3.2 Select APIs my organization uses and search for WindowsDefenderATP.

4. Under Application permissions, enable AdvancedQuery.Read.All in the AdvancedQuery section and Machine.Read.All in the Machine section, then click Add permissions.

   

5. Click Grant admin consent to finalize permissions.

   

---

Grant Access to Subscriptions

4.1 If you have Azure resources to inventory, such as App Services or storage accounts, grant subscription access. Search for Subscriptions and click the key icon.

4.2 Select the subscription name.

4.3 In Access Control (IAM), click Add role assignment.

4.4 Under the Role tab, select Reader.

4.5 On the Members tab, confirm the Reader role, then click + Select members.

4.6 Enter the application name created in Create an App Registration 1 (e.g., vScope) in the search bar and click Select.

4.7 Click Review + assign to save.

---

Set Up the Azure RM Probe in vScope

5.1 In Azure’s Overview section, copy the Application (client) ID.

5.2 Open vScope, navigate to Discovery Manager, create an Azure RM probe (+ Credential), and paste the Application ID.

5.3 Go to Certificates & secrets in Azure, then click + New client secret.

5.4 Add a description (e.g., vScope), select an expiry date, and click Add.

5.5 Copy the client secret value immediately (it will only be shown once) and paste it into the Key field in vScope.

5.6 Click Test Credential in vScope. If it’s successful, the indicator should turn green.

---

Common Errors

Error	What happened?	Suggested action
Failed to retrieve…	vScope was not able to retrieve data using the specified API endpoint.	Confirm that the vScope Azure application has the correct API permissions.
SSLHandshakeException	An issue connecting to Azure.	Ensure the connection between vScope and Azure is properly configured.
java.lang.RunTimeException: Found Duplicate ID’s	Microsoft Graph API returns identical values	May be resolved by itself depending on what the Microsoft Graph API returns