Skip to main content

Azure Integrations - User Guide

In this article, you will understand step by step how to easily integrate Scytale with Azure integrations

Learn how to connect multiple Azure services seamlessly, simplifying integration and ensuring access for most Microsoft integrations. We will guide you through setting up permissions for Azure services integrated with Scytale.

Permissions for Azure Integrations

Azure authorizes these integrations through an Azure RBAC role assignment on the subscription. Assign one of the following to the app registration at subscription scope:

  1. Reader - recommended. The built-in read-only role. It covers every read action Scytale uses and is the simplest option.

  2. Custom role. Use this only if your organization won't grant a built-in role. See Custom Role Definition below.

  3. Monitoring Reader role. The built-in read-only role specifically for Azure Monitor.

Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for reliable audit evidence collection.

Please note: This guide describes how to connect the Azure services listed at the bottom of this page. Any service not listed there has a separate guide.

How to Connect

  1. In Scytale, go to 'Integrations'.

  2. Search for the Azure service you want to connect and select 'Connect'.

  3. Paste your Directory (tenant) ID, Application (client) ID, client secret value & Subscription ID.

  4. Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.

You have now successfully connected to Microsoft Azure.

Repeat these steps for each Microsoft Azure service you want to connect. The same app registration and credentials are used for all of them.

How To Create Credentials in Azure

Step 1 - Register an application

  1. Sign in to the Azure portal and go to Microsoft Entra ID.

  2. On the left menu, select App registrations, then select New registration.

  3. Enter a name for the application, for example scytale-ai-azure-integrations.

  4. Under Supported account types, select Accounts in this organizational directory only, which is the single-tenant option.

  5. A redirect URI is not required. Select Register.

  6. On the application's Overview page, under Essentials, copy the Application (client) ID and the Directory (tenant) ID. Paste both into the Scytale integration page.

Step 2 - Create a client secret

  1. Go to Certificates & secrets, then select New client secret.

  2. Enter a description, for example scytale-dev key.

  3. Set Expires to 24 months, or until your contract ends. Scytale cannot collect data after the secret expires.

  4. Select Add.

  5. Copy the secret Value and paste it into the Scytale integration page. Copy it immediately, as Azure hides it after you leave the page. Copy the Value, not the Secret ID. The value must be at least 32 characters.

Step 3 - Assign the Reader role on the subscription

This step is what grants Scytale access. Registering the application and creating a secret is not enough on its own.

  1. In the Azure portal, go to Subscriptions and select the subscription you want Scytale to read.

  2. Select Access control (IAM), then select the Role assignments tab.

  3. Select Add, then select Add role assignment.

  4. On the Role tab, search for Reader and select it. Select Next.

  5. On the Members tab, select User, group, or service principal. Do not select Managed identity.

  6. Select Select members, search for the application you registered in Step 1, select it, then select Select.

  7. Select Next, then select Review + assign.

Role assignments take 1 to 5 minutes to propagate. If the connection fails immediately after you assign the role, wait a few minutes and try again.

Step 4 - Copy the Subscription ID

  1. In the Azure portal, go to Subscriptions.

  2. Copy the Subscription ID of the subscription you assigned the Reader role to.

  3. Paste it into the Scytale integration page.

Step 5 (optional) - Azure Key Vault only: grant data-plane access

Azure Key Vault only. Skip this unless you're connecting Azure Key Vault. Key metadata lives behind Key Vault's own permission layer, which the subscription-level Reader role does not reach. Without this step Azure Key Vault connects successfully but returns no data, with no error and an empty result. Scytale reads key names, expiry dates, and rotation policies only, and never key material or secret values.

How you grant it depends on the vault's permission model, shown on the vault under Settings then Access configuration:

  • Azure role-based access control - assign the built-in Key Vault Reader role to the app registration, at subscription or individual vault scope. Follow the same steps as Step 3, selecting Key Vault Reader instead of Reader.

  • Vault access policy - add an access policy for the app registration granting Key permissions: Get and List.

Repeat for each vault, unless you assigned Key Vault Reader at subscription scope. The equivalent DataActions are Microsoft.KeyVault/vaults/keys/read and Microsoft.KeyVault/vaults/keyrotationpolicies/read.
​
​

Custom Role Definition

Use this only if your organization won't grant the built-in Reader role.

  1. Replace {your-subscription-id} with your Subscription ID from Step 4.

  2. In the Azure portal. Go to your subscription, select Access control (IAM), select Add, then select Add custom role.

On the Basics tab set Baseline permissions to Start from JSON and upload a file containing the definition below. The portal expects this nested format.

{
  "properties": {
    "roleName": "Scytale Compliance Reader",
    "description": "Read-only access for Scytale Azure evidence collection.",
    "assignableScopes": ["/subscriptions/{your-subscription-id}"],
    "permissions": [
      {
        "actions": [
          "Microsoft.Resources/subscriptions/read",
          "Microsoft.Resources/subscriptions/resourceGroups/read",
          "Microsoft.Resources/subscriptions/resources/read",

          "Microsoft.Sql/servers/read",
          "Microsoft.Sql/servers/databases/read",
          "Microsoft.Sql/servers/databases/transparentDataEncryption/read",
          "Microsoft.Sql/servers/databases/backupShortTermRetentionPolicies/read",
          "Microsoft.Sql/servers/databases/replicationLinks/read",
          "Microsoft.Sql/servers/encryptionProtector/read",
          "Microsoft.Sql/managedInstances/read",
          "Microsoft.Sql/managedInstances/databases/read",
          "Microsoft.Sql/managedInstances/databases/backupShortTermRetentionPolicies/read",
          "Microsoft.Sql/managedInstances/databases/transparentDataEncryption/read",
          "Microsoft.Sql/managedInstances/encryptionProtector/read",
          "Microsoft.DBforMySQL/flexibleServers/read",
          "Microsoft.DBforMySQL/flexibleServers/backups/read",

          "Microsoft.Storage/storageAccounts/read",
          "Microsoft.Storage/storageAccounts/fileServices/read",
          "Microsoft.Storage/storageAccounts/blobServices/containers/read",
          "Microsoft.Storage/storageAccounts/managementPolicies/read",

          "Microsoft.Insights/workbooks/read",
          "Microsoft.Insights/actionGroups/read",
          "Microsoft.Insights/metricAlerts/read",
          "Microsoft.AlertsManagement/alerts/read",

          "Microsoft.Compute/virtualMachines/read",
          "Microsoft.Compute/disks/read",
          "Microsoft.Compute/virtualMachineScaleSets/read",
          "Microsoft.Network/networkInterfaces/read",

          "Microsoft.Network/azureFirewalls/read",
          "Microsoft.Network/firewallPolicies/read",
          "Microsoft.Network/firewallPolicies/ruleCollectionGroups/read",
          "Microsoft.Network/ipGroups/read",
          "Microsoft.Network/virtualNetworks/read",
          "Microsoft.Network/networkSecurityGroups/read",
          "Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/read",
          "Microsoft.Network/frontDoorWebApplicationFirewallPolicies/read",

          "Microsoft.Authorization/roleAssignments/read",
          "Microsoft.Authorization/roleDefinitions/read",

          "Microsoft.DocumentDB/databaseAccounts/read",
          "Microsoft.DBforPostgreSQL/serverGroupsv2/read",

          "Microsoft.Insights/diagnosticSettings/read",
          "Microsoft.OperationalInsights/workspaces/read",
          "Microsoft.OperationalInsights/workspaces/tables/read"
        ],
        "notActions": [],
        "dataActions": [],
        "notDataActions": []
      }
    ]
  }
}



Permissions used per Azure Integration

Every integration also uses Microsoft.Resources/subscriptions/read in addition to the actions listed. You only need the entries for the services you actually connect.

  1. Azure SQL Databases

    Microsoft.Sql/servers/read
    Microsoft.Sql/servers/databases/read
    Microsoft.Sql/servers/databases/transparentDataEncryption/read
    Microsoft.Sql/servers/databases/backupShortTermRetentionPolicies/read
    Microsoft.Sql/servers/databases/replicationLinks/read
    Microsoft.Sql/servers/encryptionProtector/read
    Microsoft.Sql/managedInstances/read
    Microsoft.Sql/managedInstances/databases/read
    Microsoft.Sql/managedInstances/databases/backupShortTermRetentionPolicies/read
    Microsoft.Sql/managedInstances/databases/transparentDataEncryption/read
    Microsoft.Sql/managedInstances/encryptionProtector/read
    Microsoft.DBforMySQL/flexibleServers/read
    Microsoft.DBforMySQL/flexibleServers/backups/read

  2. Azure Storage Accounts

    Microsoft.Storage/storageAccounts/read
    Microsoft.Storage/storageAccounts/fileServices/read
    Microsoft.Storage/storageAccounts/blobServices/containers/read
    Microsoft.Storage/storageAccounts/managementPolicies/read
    Microsoft.Resources/subscriptions/resourceGroups/read
    Microsoft.Insights/workbooks/read
    Microsoft.Insights/actionGroups/read
    Microsoft.Insights/metricAlerts/read
    Microsoft.AlertsManagement/alerts/read

  3. Azure Virtual Machines

    Microsoft.Compute/virtualMachines/read
    Microsoft.Compute/disks/read
    Microsoft.Compute/virtualMachineScaleSets/read
    Microsoft.Network/networkInterfaces/read

  4. Azure Firewall

    Microsoft.Network/azureFirewalls/read
    Microsoft.Network/firewallPolicies/read
    Microsoft.Network/firewallPolicies/ruleCollectionGroups/read
    Microsoft.Network/ipGroups/read

  5. Azure Subscriptions

    Microsoft.Authorization/roleAssignments/read
    Microsoft.Authorization/roleDefinitions/read

  6. Azure Virtual Network

    Microsoft.Network/virtualNetworks/read
    Microsoft.Network/networkSecurityGroups/read

  7. Azure Web Application Firewall

    Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/read
    Microsoft.Network/frontDoorWebApplicationFirewallPolicies/read

  8. Azure Cosmos DB

    Microsoft.DocumentDB/databaseAccounts/read
    Microsoft.DBforPostgreSQL/serverGroupsv2/read

  9. Azure Key Vault

    Microsoft.Resources/subscriptions/resources/read

    • Plus the data-plane grant from Step 5 above.

  10. Azure Monitor

    Microsoft.Insights/diagnosticSettings/read
    Microsoft.OperationalInsights/workspaces/read
    Microsoft.OperationalInsights/workspaces/tables/read
    Microsoft.Storage/storageAccounts/read
    Microsoft.Resources/subscriptions/resources/read

Supported Azure Integrations

You can use the same credentials for connecting any of the following:

  • Azure SQL Databases

  • Azure Storage Accounts

  • Azure Virtual Machines

  • Azure Firewall

  • Azure Subscriptions

  • Azure Virtual Network

  • Azure Web Application Firewall

  • Azure Cosmos DB

  • Azure Key Vault

  • Azure Monitor

Related Articles
Did this answer your question?