Azure

Experienced with Azure? Here’s a quick summary to get started:

1. Create App Registration
2. Add Permissions for various services:
   • AuditLog: AuditLog.Read.All (Read all audit log data)
   • DeviceManagementConfiguration: DeviceManagementConfiguration.Read.All (Read Microsoft Intune device configurations and policies)
   • DeviceManagementManagedDevices: DeviceManagementManagedDevices.Read.All (Read Microsoft Intune devices)
   • Directory: Directory.Read.All (Read Azure AD data)
   • Reports: Reports.Read.All (Read all usage reports)
   • AdvancedQuery: AdvancedQuery.Read.All (365 Defender)
   • Machine: Machine.Read.All (365 Defender)
3. Grant Permissions to the subscriptions you want to inventory.

Set up App registration in Azure

To inventory Azure Resource Manager (Azure RM), vScope needs read permissions for your subscriptions. This guide walks through creating an app in Azure and generating a key.

Prerequisite

Ensure you have permissions to set up applications in Azure. Learn more about roles and permissions here.

Create an App registration

Log in to Azure Resource Manager, search for App registrations, and select it.

Click + New registration to create the vScope application.

Name the application (e.g., vScope), choose Accounts in this organizational directory only, and click Register.

Add API Permissions for Microsoft Graph

In the API Permissions section, click + Add a permission.

Under Microsoft APIs, select Microsoft Graph.

Select Application permissions.

Choose the following permissions and click Add permissions:

• AuditLog: AuditLog.Read.All (Read all audit log data)
• DeviceManagementConfiguration: DeviceManagementConfiguration.Read.All (Read Microsoft Intune device configurations and policies)
• DeviceManagementManagedDevices: DeviceManagementManagedDevices.Read.All (Read Microsoft Intune devices)
• Directory: Directory.Read.All (Read Azure AD data)
• Reports: Reports.Read.All (Read all usage reports)

Grant these permissions by clicking Grant admin consent.

Add API Permissions for Defender

Click + Add a permission again.

Select APIs my organization uses and search for WindowsDefenderATP.

Under Application permissions, enable AdvancedQuery.Read.All in the AdvancedQuery section and Machine.Read.All in the Machine section, then click Add permissions.

Click Grant admin consent to finalize permissions.

Grant Access to Subscriptions

If you have Azure resources to inventory, such as App Services or storage accounts, grant subscription access. Search for Subscriptions and click the key icon.

Select the subscription name.

In Access Control (IAM), click Add role assignment.

Under the Role tab, select Reader.

On the Members tab, confirm the Reader role, then click + Select members.

Enter the application name created in Create an App Registration 1 (e.g., vScope) in the search bar and click Select.

Click Review + assign to save.

Set up the Azure RM Probe in vScope

In Azure’s Overview section, copy the Application (client) ID.

Open vScope, navigate to Discovery Manager, create an Azure RM probe (+ Credential), and paste the Application ID.

Go to Certificates & secrets in Azure, then click + New client secret.

Add a description (e.g., vScope), select an expiry date, and click Add.

Copy the client secret value immediately (it will only be shown once) and paste it into the Key field in vScope.

Click Test Credential in vScope. If it’s successful, the indicator should turn green.

Good job! You are now ready to inventory Azure Resource Manager.

Matching Local and Azure Domains

After discovering Azure Resource Manager, we recommend checking out Suggestions under Discovery > Suggestions. Here, you can enhance vScope’s data quality by defining rules that improve how assets are identified.

Caution

Be careful when selecting domains. Incorrect matches may cause vScope to merge unrelated assets into a single asset.

For Azure, it is common to have different domain names in the local Active Directory compared to Azure and Microsoft Entra ID. To help vScope interpret this correctly, you should create a Custom suggestion.

• From the dropdown, select the domains that you consider equivalent (e.g., infrasightlabs.com and isl.com).
• Click Apply to save.
• Rerun a Discovery.

Once applied, and after running next discovery, vScope will recognize these domains as the same, improving its ability to identify unique and duplicate assets accurately.

Common Errors

Error	What happened?	Suggested action
Failed to retrieve…	vScope was not able to retrieve data using the specified API endpoint.	Confirm that the vScope Azure application has the correct API permissions.
SSLHandshakeException	An issue connecting to Azure.	Ensure the connection between vScope and Azure is properly configured.
java.lang.RunTimeException: Found Duplicate ID’s	Microsoft Graph API returns identical values	May be resolved by itself depending on what the Microsoft Graph API returns