> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure

> Connect Azure to CodeAnt for Cloud Security Posture Management (CSPM)

### How It Works

1. **Permissions**

   > [tab] Azure Portal
   >
   > **a. Register an application**
   >
   > 1. Sign in to the [Azure Portal](https://portal.azure.com) and search for **Microsoft Entra ID**.
   >
   >    ![Search Microsoft Entra ID](https://mintcdn.com/codeantai/vIQvFHilaNIlEj3B/images/control_center/cloud_security/azure/portal/search-entra-id.png?fit=max\&auto=format\&n=vIQvFHilaNIlEj3B\&q=85\&s=216fceccceae93937c2ccc27b1a96894)
   > 2. In the left menu open **Manage → App registrations**.
   >
   >    ![App registrations menu](https://mintcdn.com/codeantai/vIQvFHilaNIlEj3B/images/control_center/cloud_security/azure/portal/app-registration-menu.png?fit=max\&auto=format\&n=vIQvFHilaNIlEj3B\&q=85\&s=ced83a37d83822c0a819337f111d25b2)
   > 3. Click **+ New registration**, give it a name (e.g. `codeant-cspm`), leave the defaults, and click **Register**.
   >
   > **b. Create a client secret**
   >
   > 1. In the app registration's left menu, open **Manage → Certificates & secrets**.
   >
   >    ![Certificates & secrets](https://mintcdn.com/codeantai/vIQvFHilaNIlEj3B/images/control_center/cloud_security/azure/portal/certificates-and-secrets.png?fit=max\&auto=format\&n=vIQvFHilaNIlEj3B\&q=85\&s=ab0cdb790e14f2d767e6e749f9df2826)
   > 2. Click **+ New client secret**, set an expiry, and click **Add**. Copy the secret **Value** immediately - it is only shown once.
   >
   >    ![New client secret](https://mintcdn.com/codeantai/vIQvFHilaNIlEj3B/images/control_center/cloud_security/azure/portal/new-client-secret.png?fit=max\&auto=format\&n=vIQvFHilaNIlEj3B\&q=85\&s=c163b5a2780915ae22c4cd4dc801b050)
   >
   > **c. Grant Microsoft Graph permissions**
   >
   > 1. In the app registration's left menu, open **Manage → API permissions**.
   > 2. Click **+ Add a permission**, choose **Microsoft Graph**, then **Application permissions**.
   >
   >    ![Microsoft Graph application permissions](https://mintcdn.com/codeantai/vIQvFHilaNIlEj3B/images/control_center/cloud_security/azure/portal/microsoft-graph-detail.png?fit=max\&auto=format\&n=vIQvFHilaNIlEj3B\&q=85\&s=edee549bf228971c36bebb6792335290)
   > 3. Search for and tick: `AuditLog.Read.All`, `Directory.Read.All`, `Policy.Read.All`. Click **Add permissions**.
   >
   >    ![Select permissions](https://mintcdn.com/codeantai/vIQvFHilaNIlEj3B/images/control_center/cloud_security/azure/portal/select-graph-permissions.png?fit=max\&auto=format\&n=vIQvFHilaNIlEj3B\&q=85\&s=d010de695ad77c8de2841390c1f5a190)
   > 4. Click **Grant admin consent for \<tenant>**, then **Yes**. Each permission's status should turn green.
   >
   > **d. Assign the Reader role on the subscription**
   >
   > 1. In the Azure Portal top search bar, type **Subscriptions** and click the first plain **Subscriptions** result under *Services* (not *Billing subscriptions* or the *Resource Manager* variant).
   > 2. From the list, click the subscription you want CodeAnt to scan. (If you have many subscriptions, repeat this step for each one.)
   > 3. In the left menu of the subscription blade, click **Access control (IAM)**.
   > 4. Click **+ Add** at the top of the page, then choose **Add role assignment** from the dropdown.
   > 5. On the **Role** tab, search for `Reader`, select the **Reader** row, and click **Next**.
   >
   >    ![Add Reader role](https://mintcdn.com/codeantai/vIQvFHilaNIlEj3B/images/control_center/cloud_security/azure/portal/add-reader-role.png?fit=max\&auto=format\&n=vIQvFHilaNIlEj3B\&q=85\&s=7ab2432f8347493be71122d656361b78)
   > 6. On the **Members** tab, leave **Assign access to** as *User, group, or service principal*, then click **+ Select members**.
   > 7. In the **Select members** panel on the right, type `codeant-cspm` (or the exact name you used in step a.3) into the search box, click the matching application in the results, and click **Select** at the bottom.
   > 8. Click **Next** until you reach the **Review + assign** tab, then click **Review + assign** to commit.
   >
   > **e. Collect the credentials**
   >
   > From the app registration **Overview** page copy the **Application (client) ID** and **Directory (tenant) ID**. Use these together with the client secret from step b in the next section. (The **Subscription ID**, found on the subscription's **Overview** page, isn't part of the saved credential - it's only used for the optional validation probe in step 2.)

   > [tab] Azure CLI
   >
   > * **Get the tenant ID**
   >   ```bash theme={"theme":"css-variables"}
   >   az account show --query tenantId -o tsv
   >   ```
   > * **Get the client (app) ID**
   >   ```bash theme={"theme":"css-variables"}
   >   az ad app list --display-name "codeant-cspm" --query "[0].appId" -o tsv
   >   ```
   > * **Create (or reset) a client secret**
   >   ```bash theme={"theme":"css-variables"}
   >   az ad app credential reset \
   >     --id YOUR_APP_ID \
   >     --append \
   >     --credential-description "exporter-script" \
   >     --years 1 \
   >     --query password -o tsv
   >   ```
   >   * This command outputs the new secret.
   > * **Get the subscription ID** (the one you want CodeAnt to scan)
   >   ```bash theme={"theme":"css-variables"}
   >   az account show --query id -o tsv
   >   ```
   > * **Ensure the SP has Reader rights**
   >   ```bash theme={"theme":"css-variables"}
   >   az role assignment create \
   >     --assignee YOUR_APP_ID \
   >     --role Reader \
   >     --scope "/subscriptions/YOUR_SUBSCRIPTION_ID"
   >   ```
   > * **Grant Microsoft Graph application permissions** (`AuditLog.Read.All`, `Directory.Read.All`, `Policy.Read.All`)
   >   ```bash theme={"theme":"css-variables"}
   >   GRAPH_APP_ID=00000003-0000-0000-c000-000000000000
   >
   >   az ad app permission add --id YOUR_APP_ID --api $GRAPH_APP_ID \
   >     --api-permissions \
   >       b0afded3-3588-46d8-8b3d-9842eff778da=Role \
   >       7ab1d382-f21e-4acd-a863-ba3e13f7da61=Role \
   >       246dd0d5-5bd0-4def-940b-0421030a5b68=Role
   >
   >   az ad app permission admin-consent --id YOUR_APP_ID
   >   ```
   >   * The three GUIDs are the well-known role IDs for `AuditLog.Read.All`, `Directory.Read.All`, and `Policy.Read.All` on Microsoft Graph. Admin consent requires a Global Administrator (or Privileged Role Administrator) signed in.

2. **Settings**
   * In the CodeAnt UI navigate to **Settings → Cloud Security → Azure**.
   * Under **Azure Credentials**, fill in **Directory (tenant) ID**, **Application (client) ID**, and **Azure Client Secret**, then click **Save** in the top right.
   * (Optional) Under **Validate against subscription**, paste a Subscription ID and click **Validate** to confirm the service principal can read that subscription. A green confirmation means the **Reader** role is assigned and resources are listable; it does not test the Graph permissions, so make sure admin consent in step 1c really turned green. The Subscription ID is **not** stored - it is only used for this probe.
   * ![Cloud Security – Azure form](https://mintcdn.com/codeantai/vIQvFHilaNIlEj3B/images/control_center/cloud_security/azure/setup.png?fit=max\&auto=format\&n=vIQvFHilaNIlEj3B\&q=85\&s=afb9653ff810c4b7dcfb2753b0a87d42)

3. **Start a Scan**
   * Go to **Cloud Security -> Start a New Scan** and pick your Azure connection.
   * Within 15-20 minutes, the scan will be completed, and you will see the results.

### Optional: cover two extra App Service checks

The built-in **Reader** role misses two read actions that a pair of App Service checks (`app_function_access_keys_configured`, `app_function_ftps_deployment_disabled`) need. To include them, create a small custom role and assign it alongside Reader:

1. On the subscription's **Access control (IAM)** page choose **+ Add → Add custom role**, pick **Start from JSON**, and upload this file with your subscription ID filled in:

```json expandable theme={"theme":"css-variables"}
{
  "properties": {
    "roleName": "CodeAntExtraRead",
    "description": "Read-only actions not covered by Reader, used by two App Service checks.",
    "assignableScopes": ["/subscriptions/<your-subscription-id>"],
    "permissions": [
      {
        "actions": [
          "Microsoft.Web/sites/host/listkeys/action",
          "Microsoft.Web/sites/config/list/Action"
        ],
        "notActions": [],
        "dataActions": [],
        "notDataActions": []
      }
    ]
  }
}
```

2. Assign the new role to `codeant-cspm` the same way as Reader.

### VM Scanning permissions

[VM Scanning](https://docs.codeant.ai/cloud_security/vm-scanning.md) reuses this same service principal but needs the `Microsoft.Compute/snapshots/*` actions, which **Reader does not grant** - it creates a temporary disk snapshot, reads it, and deletes it. Assign the built-in **Disk Snapshot Contributor** role to the CSPM app **alongside** Reader (Reader is still needed to read the source disk):

> [tab] Azure Portal
>
> 1. Open the subscription → **Access control (IAM)** → **+ Add → Add role assignment**.
> 2. On the **Role** tab, search for `Disk Snapshot Contributor`, select it, and click **Next**.
> 3. On the **Members** tab, click **+ Select members**, choose your CSPM app (e.g. `codeant-cspm`), and click **Select**.
> 4. Click **Review + assign**. Repeat for each subscription you want VM Scanning to cover.

> [tab] Azure CLI
>
> ```bash theme={"theme":"css-variables"}
> az role assignment create \
>   --assignee YOUR_APP_ID \
>   --role "Disk Snapshot Contributor" \
>   --scope "/subscriptions/YOUR_SUBSCRIPTION_ID"
> ```

> [!WARNING]
>
> Without this role the scan fails when creating the snapshot, returning `403 Forbidden` on a `PUT .../providers/Microsoft.Compute/snapshots/...` request.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.