Onboarding an Azure Subscription

1. In the CloudGuard portal, open Assets > Environments.

2. For first-time onboarding, click Azure and follow the setup instructions.

   Or, if you already onboarded environment(s), from the top menu, select Add > Azure Subscription.

3. Select to onboard a Single account.

4. Select the cloud platform that hosts the account: Standard, Azure Government, or Azure China.

5. Enter your Subscription ID.

6. Select operation mode: Read-Only or Manage.

7. Click Next.

1. On the Configurations page, enter a name for the environment (optional) to identify it in the CloudGuard portal.

2. Select an Organizational Unit to which to associate the environment.

   Note - This is an optional step. Later, you can use the Organizational Units page in Assets to create and change associations.

3. Click Next.

1. On the Connect page, click Onboarding script to review it.

   Note - To run the script in a quiet mode that skips all questions to the user, run it with the --quiet flag .

2. Log in to the Azure Cloud Shell.

3. Copy and run the command provided in the CloudGuard wizard. As the program runs it prints out its actions and shows resources created in your Azure account.

   Wait until the Cloud Shell shows the outputs for your environment.

   Example

   -----Outputs-----

   Tenant ID:                  XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX

   Application (client) ID:    XXXXXXXXXXXXXXXXXXXXXXX

   Secret Key:                 XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX

   Subscription ID:            XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX

4. Copy and paste to the CloudGuard wizard these values:

   • Tenant ID

   • Application ID

   • Secret Key

5. Click Onboard. The onboarding starts.

   When CloudGuard finishes onboarding, you get a notification, and the onboarded environment appears on the Environments page.

For some subscriptions, you need to add the admin consent permission to the application. Follow the instructions in the Microsoft Azure Collection of integrated cloud services that developers and IT professionals use to build, deploy, and manage applications through a global network of data centers managed by Microsoft®. Cloud Shell.

To grant admin consent to the CloudGuard application:

1. In the navigation tree, go to App registrations > All applications and find the application you created with the script (by default, CloudGuard-Connect).

2. Click your CloudGuard app.

3. In the navigation tree, select Manage > API permissions.

4. The page shows in the permissions status that they need the admin consent.

5. Above the permissions list, click Grant admin consent for Check Point Software Technologies and confirm the option.

To remove the CloudGuard resources created in your Azure subscription:

• Run the onboarding script with the --clean flag.

  You can use the option for troubleshooting an unsuccessful onboarding. Make sure you use the same parameters as in the initial command.