Learn how to connect multiple Azure services seamlessly using the same credentials, simplifying integration and ensuring access for most Microsoft integrations. We will guide you through setting up permissions for Azure services integrated with Scytale.
Please Note: This guide covers the integration process for most Azure services, excluding Microsoft Intune, Azure Active Directory, Azure DevOps, and Azure Boards, which have separate guides.
Permissions for Azure Integrations
Scytale requires the following Microsoft Graph application permissions to collect audit evidence.
User.Read.All
GroupMember.Read.All
Group.Read.All
Directory.Read.All
Application.Read.All
Reports.Read.All
UserAuthenticationMethod.Read.All is required for using group IDs.
A Global Admin must connect the application and grant admin consent. The application connects to a single directory, so if your organization has more than one directory, Scytale collects data only from the directory associated with the registered application.
Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for reliable audit evidence collection.
How to Connect Scytale and Azure Services
In Scytale, go to 'Integrations'.
Search for Azure integrations and select 'Connect'.
Paste your Application ID, Secret Value & Tenant.
Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.
You have now successfully connected to Azure Integrations.
How To Create Credentials in Azure
Step 1 — Register an Application
Sign in to the Azure portal.
Go to Microsoft Entra ID.
On the left menu, select App registrations, then select New registration.
Enter a Name for the application, for example scytale-ai-integration.
Under Supported account types, select Accounts in this organizational directory only — the single-tenant option. A single-tenant registration is required, otherwise the application must be approved by Microsoft.
A redirect URI is not required.
Select Register.
Step 2 — Copy the Application ID and Tenant
On the application's Overview page, under Essentials, copy the Application (Client) ID and the Directory (Tenant) ID.
Paste these values into the Scytale integration page.
Step 3 — Create a Client Secret
Go to Certificates & secrets, then select New client secret.
Enter a Description, for example scytale-dev key.
Set Expires to 24 months, or until your contract ends. Scytale cannot collect data after the secret expires.
Select Add.
Step 4 — Copy the Secret Value
Copy the secret Value and paste it into the Scytale integration page.
Copy the value immediately, as Azure hides it after you leave the page.
Step 5 — Add API Permissions and Grant Admin Consent
Go to the API permissions page and add the permissions listed under Required Permissions.
Select and confirm the permissions.
Select Grant admin consent for Default Directory to approve the permissions.
Granting admin consent is required. Without selecting Grant admin consent for Default Directory, the permissions remain unconsented and Scytale cannot collect data.
Supported Azure Integrations
You can use the same credentials for connecting any of the following:
Azure SQL Databases
Azure Storage Accounts
Azure Virtual Machines
Azure Firewall
Azure Subscriptions
Azure Virtual Network
Azure Web Application Firewall
Azure Cosmos DB
Azure Key Vault