Onboarding an Azure Subscription

This topic describes onboarding one Azure subscription. For onboarding an Azure Organization, see Onboarding Azure Organizations.

Prerequisites

Before onboarding your Azure subscription, make sure that you have required permissions assigned through the Application Administrator or Owner role. For more information, see Permissions.

Onboarding in the Portal

STEP 1 - Welcome

In the CloudGuard portal, open Assets > Environments.
For first-time onboarding, click Azure and follow the setup instructions.

Or, if you already onboarded environment(s), from the top menu, select Add > Azure Subscription.
Select to onboard a Single account.
Select the cloud platform that hosts the account: Standard, Azure Government, or Azure China.
Enter your Subscription ID.
Select operation mode: Read-Only or Manage.

Click Next.

STEP 2 - Configurations

On the Configurations page, enter a name for the environment (optional) to identify it in the CloudGuard portal.

Select an Organizational Unit to which to associate the environment.

Note - This is an optional step. Later, you can use the Organizational Units page in Assets to create and change associations.

Click Next.

STEP 3 - Connect

On the Connect page, click Onboarding script to review it.

Note - To run the script in a quiet mode that skips all questions to the user, run it with the --quiet flag .

Log in to the Azure Cloud Shell.
Copy and run the command provided in the CloudGuard wizard. As the program runs it prints out its actions and shows resources created in your Azure account.

Wait until the Cloud Shell shows the outputs for your environment.
Example
-----Outputs-----
```
Tenant ID:                  XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX
```
```
Application (client) ID:    XXXXXXXXXXXXXXXXXXXXXXX
```
```
Secret Key:                 XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX
```
```
Subscription ID:            XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX
```
Copy and paste to the CloudGuard wizard these values:
- Tenant ID
- Application ID
- Secret Key
Click Onboard. The onboarding starts.

When CloudGuard finishes onboarding, you get a notification, and the onboarded environment appears on the Environments page.

This procedure creates a default CSPM policy with two rulesets: Azure CloudGuard Checkup and Azure CIS Foundation v. 1.5.0.

Troubleshooting

Admin Consent

For some subscriptions, you need to add the admin consent permission to the application. Follow the instructions in the Microsoft Azure Cloud Shell.

To grant admin consent to the CloudGuard application:

In the navigation tree, go to App registrations > All applications and find the application you created with the script (by default, CloudGuard-Connect).
Click your CloudGuard app.
In the navigation tree, select Manage > API permissions.
The page shows in the permissions status that they need the admin consent.
Above the permissions list, click Grant admin consent for Check Point Software Technologies and confirm the option.

Unsuccessful onboarding

To remove the CloudGuard resources created in your Azure subscription:

Run the onboarding script with the --clean flag.

You can use the option for troubleshooting an unsuccessful onboarding. Make sure you use the same parameters as in the initial command.