STEP 5: Azure Advanced security configurations

This step is optional.

The following steps are done by Microsoft Azure Subscription Owner (or Subscription Contributor) role.

An Azure Automation Account resource is deployed to collect data for additional security policies listed here. The Azure Active Directory control plane exposes the data only through PowerShell that needs to run under a Global AD reader credential. Please note that the credential used should not have MFA enabled and if conditional access is used, exclude Global AD reader from the conditional access.

To ensure that Cloudneeti does not ever store/have access to a global AD reader, it is recommended to deploy a small PowerShell script under customer’s control in their own Azure subscription. The metadata collected after running a script is then pushed to a Cloudneeti API that you registered during the Cloudneeti API key generation.

5.1 Collect Information

Information	Source / Portal to use	User
Cloudneeti License Id	Cloudneeti	License Admin
Cloudneeti Account Id	Cloudneeti	License Admin
Azure Active Directory Id	Cloudneeti	License Admin
Azure Subscription Id	Cloudneeti	License Admin
Azure Active Directory Global Reader Id	Microsoft Azure	Global Reader
Azure Active Directory Global Reader password	Microsoft Azure	Global Reader
Cloudneeti data collector Application Id	Microsoft Azure	Subscription Owner
Cloudneeti data collector Application secret	Microsoft Azure	Subscription Owner
Cloudneeti Environment	Cloudneeti Team	License Admin
Cloudneeti API key	Cloudneeti Team	License Admin
Cloudneeti Azure IAM Data Collector Artifacts Storage Name	Cloudneeti Team	License Admin
Cloudneeti Azure IAM Data Collector Version	Cloudneeti Team	License Admin
Cloudneeti Azure data collector artifacts storage access Key	Cloudneeti Team	License Admin

Cloudneeti license and account details

Login to Cloudneeti portal as a License Admin.

License id

Navigate to Features and Quotas under Configurations
Copy license ID and paste to notepad.

Account id

Navigate to Cloud Accounts in Configurations
Copy account ID and paste to notepad.

Generate Cloudneeti API key

Go to API portal and Sign up.
Fill the required fields in the sign-up form
You will receive a confirmation mail for sign-up, Click on the confirmation link.
The confirmation link will ask you for change password (info: You can use the password your used when signing up)
You are signed up successfully

Retrieve and activate API key

Retrieve and activate your API key using the Cloudneeti API portal

Click on PRODUCTS
Select Unlimited
Click on Subscribe

This will notify Cloudneeti to activate your API subscription access. Please wait for the activation to be done. When Cloudneeti activates your subscription, you will get an email notification.

Once you receive the confirmation, proceed with the following steps.

Click on Username
Select Profile
Click on Show
Copy the Primary key to your notepad.

Cloudneeti artifacts and data collector details

Contact Cloudneeti Team for:

Cloudneeti Environment
Cloudneeti Azure IAM Data Collector Artifacts Storage Name
Cloudneeti Azure IAM Data Collector Artifacts Storage Access Key
Cloudneeti Azure IAM Data Collector Version

Azure details

Login to Azure portal https://portal.azure.com as a subscription owner.

Azure Directory ID

Click on Azure Active Directory on the primary menu
Click on Properties on the secondary menu
Copy Directory ID to a notepad

Azure Subscription ID

Choose your Azure AD tenant by selecting your Azure subscription in the top right corner of the page
Select Default Directory
Click on Subscriptions (1) on the primary menu
Select the desired Azure subscription (2)
Copy Subscription ID to a notepad

Registered Cloudneeti Application ID

Select Azure Active Directory in the primary menu
Select App Registrations in the secondary menu
Select Cloudneeti Application registered in Step 1
Copy the Cloudneeti Application id

Registered Cloudneeti Application Secret

Select Azure Active Directory in the primary menu
Select App Registrations in the secondary menu
Select Cloudneeti Application registered in Step 1
Click on new client secret in Certificates & secrets section (1)
Add Description and select expiry time
Click on Add (2)
Copy to clipboard and paste the Client Secret to your notepad. Note: You will not be able to copy this value after you move away from this screen. (3)

5.2 Provision Azure IAM data collector

Login to Azure portal https://portal.azure.com as Subscription Contributor or Subscription Owner access.

Switch to Azure AD with the Azure Subscription with pre-requisite access.

Open CloudShell
Click on Cloudshell icon on the navigation bar to open Cloudshell
Choose PowerShell from shell dropdown
Select storage

Execute below command in Cloudshell to download the Cloudneeti data collector provisioning script.

    wget https://raw.githubusercontent.com/Cloudneeti/docs_cloudneeti/master/scripts/Provision-AzureIAM-DataCollector.ps1 -O Provision-AzureIAM-DataCollector.ps1

Switch to the User directory
```
    cd $User
    
```

Run provisioning script with inline parameters

    ./Provision-AzureIAM-DataCollector.ps1 `
            -CloudneetiLicenseId <Cloudneeti License Id> `
            -CloudneetiAccountId <Cloudneeti Account Id> `
            -CloudneetiEnvironment <Cloudneeti Environment> `
            -CloudneetiApplicationId <Cloudneeti Data Collector Registered Application Id> `
            -ArtifactsName <Cloudneeti Azure IAM Data Collector Artifact Name> `
            -DataCollectorVersion <Cloudneeti Azure IAM Data Collector Version> `
            -AzureActiveDirectoryId <Azure Active Directory Id> `
            -AzureGlobalReaderEmailId <Azure Global Reader Email Id> `
            -AzureSubscriptionId <Azure Subscription Id where Azure IAM datacollector resources will be created> `
            -DataCollectorName <Friendly name for Azure IAM Data Collector resources>

Note: Contact Cloudneeti Team for ArtifactsName, DataCollectorVersion and ArtifactsAccessKey

The script will execute and prompt you for below details: Cloudneeti API key
Cloudneeti Data Collector Service Principal Secret
Cloudneeti Azure IAM Data Collector Artifacts Storage Access Key
Azure Active Directory reader password
This will create a runbook inside automation account

5.3 Apply delete lock

Apply a delete lock to prevent accidental deletion of the data collection resource group in your Azure Subscription.

Navigate to Azure IAM data collector resource group
Click on Locks (1)
Click Add (2)
Enter Lock name DoNotDelete (3)
Select Lock type as Delete (4)
Add Notes (Do not delete M365 data collector resource group) (5)
Click OK (6)

5.4 Modify the data collection schedule

Set the automation account schedule before the daily Cloudneeti data collection time.

Go to Azure IAM data collector resource group
Select Automation account
Click on Schedules
Select Schedule
Modify the schedule Time (set time about 1 hour before the daily Cloudneeti data collection time)
Click Save

Cloudneeti portal will show details for policies from next scan.

Annexture

Azure - Upgrade Advanced Security Configuration

Upgrading existing Azure advance secuirty configuration to DataCollectorVersion 1.2 includes updating runbook inside automation account provisioned for Azure cloud account to get data for new security policies.

Please refer Release Notes for latest security policy addition.