> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Azure

> Connect ThreatAware to Microsoft Azure for cloud infrastructure monitoring

## Overview

The Azure integration enables ThreatAware to collect read-only data from your Azure subscriptions, providing visibility into cloud infrastructure, resources, and security configurations.

<Info>
  **Connection Method**: OAuth with IAM Role Assignment
  **Setup Time**: 20 minutes
  **Access Required**: Azure Subscription Administrator account
</Info>

## Data collected

The Azure integration provides:

* Azure resource inventory
* Virtual machine and instance details
* Network and security configurations
* Subscription and resource group information

## Use cases

<CardGroup cols={2}>
  <Card title="Cloud Resource Monitoring" icon="cloud">
    Track Azure resources and infrastructure across subscriptions
  </Card>

  <Card title="VM Inventory Management" icon="server">
    Monitor virtual machines and compute resources
  </Card>

  <Card title="Security Configuration Validation" icon="shield-halved">
    Verify Azure security controls and network configurations
  </Card>

  <Card title="Compliance Verification" icon="clipboard-check">
    Validate cloud infrastructure meets organisational standards
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to ThreatAware">
    Access the ThreatAware dashboard and navigate to **Settings → Integrations**.
  </Step>

  <Step title="Locate Azure Integration">
    Use the search bar to find **Azure** in the integrations list.
  </Step>

  <Step title="Start Authorization">
    Click **Connect** and a dialog will appear. Click the **Authorize** button to begin the OAuth flow.
  </Step>

  <Step title="Sign In with Azure Account">
    You will be redirected to Azure:

    * Sign in with your **Subscription Administrator** account
    * Review the help article on [finding your Subscription Administrator](https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/add-change-subscription-administrator) if needed
    * Review and accept the required permissions
    * Click **Accept** to proceed

    <Tip>
      The account you use must have subscription-level admin permissions.
    </Tip>
  </Step>

  <Step title="Verify Authorization Success">
    After authorising, you'll be redirected to a ThreatAware confirmation page:

    * **If successful**: You may close the page and continue
    * **If unsuccessful**: Return and retry authorization with correct permissions
  </Step>

  <Step title="Select Subscriptions">
    If you manage multiple Azure Subscriptions:

    * Log in to your [Azure Portal](https://portal.azure.com/)
    * Navigate to **Subscriptions**
    * Select all subscriptions you want to monitor
    * Document their IDs for reference in ThreatAware
  </Step>

  <Step title="Configure IAM Role Assignment">
    For each Azure Subscription you want to monitor:

    * Log in to [Azure Portal](https://portal.azure.com/)
    * Navigate to the Subscription
    * Go to **Access Control (IAM)**
    * Click the **Role Assignments** tab
    * Click **Add** and select **Add role assignment**
  </Step>

  <Step title="Assign Reader Role to ThreatAware">
    In the role assignment dialog:

    * Choose the role **Reader**
    * Set **Assign access to**: **User, Group, or service principal**
    * In the **Select** field, search for **ThreatAware Azure Connector**
    * Click to select **ThreatAware Azure Connector**
    * Click **Save** to complete the assignment

    <Info>
      The Reader role provides read-only access to all resources in the subscription. This is the minimum required for ThreatAware monitoring.
    </Info>
  </Step>

  <Step title="Repeat for Multiple Subscriptions">
    If monitoring multiple subscriptions:

    * Repeat steps 6-7 for each subscription
    * Assign the Reader role to **ThreatAware Azure Connector** in each subscription
    * Verify all assignments are complete in the Azure Portal
  </Step>

  <Step title="Verify Connection">
    After completing all steps:

    * Return to ThreatAware and verify the **Integration Status** shows as **Active**
    * Wait for initial data synchronization
    * Verify Azure resources appear in ThreatAware
  </Step>
</Steps>

## Required permissions

<AccordionGroup>
  <Accordion title="Subscription Administrator" icon="user-shield">
    **Required**: Azure Subscription Administrator account for initial authorization

    This account needs:

    * Ability to grant consent to applications
    * Permission to manage IAM role assignments
    * Access to all subscriptions being monitored
  </Accordion>

  <Accordion title="Reader Role" icon="eye">
    **Assigned to**: ThreatAware Azure Connector (service principal)

    This role provides:

    * Read access to all resources
    * View resource properties and configurations
    * Access to resource groups and subscriptions
    * No ability to modify or delete resources
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings → Integrations** in ThreatAware
   * Confirm the Azure integration shows **Active** status

2. **Verify Data Collection**
   * Wait for initial data synchronization (typically 1 hour)
   * Log in to Azure Portal to view your resources
   * Verify the same resources appear in ThreatAware

3. **Test Multi-Subscription Setup**
   * Verify resources from all subscriptions appear in ThreatAware
   * Check that resource details are complete and accurate

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authorization Failed" icon="triangle-exclamation">
    **Symptoms**: Authorization redirects back with an error

    **Solutions**:

    * Verify you are using a **Subscription Administrator** account
    * Ensure the account has permission to grant consent to applications
    * Check that your Azure tenant is properly configured
    * Try using InPrivate/Incognito browser mode to avoid cached credentials
    * Contact your Azure administrator for assistance
  </Accordion>

  <Accordion title="Permission Denied Errors" icon="ban">
    **Symptoms**: Integration connects but shows permission or access errors

    **Solutions**:

    * Verify the **ThreatAware Azure Connector** role assignment is in place
    * Confirm the **Reader** role is assigned (not Owner or other roles)
    * Check that the role is assigned at the subscription level
    * Verify the assignment was saved successfully in the Azure Portal
    * Wait 5-10 minutes for permission changes to propagate
  </Accordion>

  <Accordion title="Missing Resources" icon="database">
    **Symptoms**: Integration shows active but Azure resources don't appear

    **Solutions**:

    * Verify the Reader role is assigned for the subscription containing resources
    * Ensure you've completed step 7 (IAM role assignment) for all subscriptions
    * Wait up to 1 hour for initial data synchronization
    * Check if resources exist in the selected subscription
    * Contact Azure support to verify role assignments
  </Accordion>

  <Accordion title="Multi-Subscription Issues" icon="network-wired">
    **Symptoms**: Only one subscription appears or some subscriptions are missing

    **Solutions**:

    * Verify the Reader role is assigned in **each** subscription
    * Confirm all role assignments were saved successfully
    * Check that you have access to all subscriptions in Azure Portal
    * Review the subscription IDs in Azure Portal match your configuration
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Azure Subscriptions Documentation" icon="book" href="https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/add-change-subscription-administrator">
    Microsoft documentation on subscription administration
  </Card>

  <Card title="Azure IAM Documentation" icon="shield-halved" href="https://docs.microsoft.com/en-us/azure/role-based-access-control/">
    Azure role-based access control (RBAC) documentation
  </Card>

  <Card title="Azure Portal" icon="globe" href="https://portal.azure.com/">
    Access your Azure Portal for resource and permission management
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Subscription Management**

  * Document all subscriptions you are monitoring with ThreatAware
  * Verify Reader role assignments after any account changes
  * Monitor integration status regularly
  * Keep track of which Azure administrator performed the setup
</Tip>

<Tip>
  **Security Considerations**

  * The Reader role provides read-only access (no data modification risk)
  * Review Azure access logs periodically for ThreatAware API activity
  * Ensure only authorised administrators manage role assignments
  * Monitor for unexpected Azure resource changes
  * Keep IAM role assignments updated when subscriptions change
</Tip>