Onboarding Azure to CloudGuard

Prerequisites

Before onboarding your AzureClosed Collection of integrated cloud services that developers and IT professionals use to build, deploy, and manage applications through a global network of data centers managed by Microsoft®. assets, make sure:

  • You have a subscription to use Azure resources

  • You are signed in with a subscription owner account

To onboard an Azure environment:

  1. Open portal.checkpoint.com and log in to the CloudGuard portal.

  2. In the CloudGuard portal, open Assets > Environments.

  3. For first-time onboarding, click Azure and follow the setup instructions. Or, if you already onboarded environment(s), then from the top menu select Add > Azure Subscription.

Complete each of these stages in the onboarding wizard:

  • Operation Mode

  • Prepare (Azure)

  • Connect

  • Name (Account Display)

  • Organizational Unit (Associate)

Note - Only change these Azure options. Other options must stay at their default values.

  1. Select operation mode, Read-Only or Manage.

  2. Select the cloud platform that hosts the account: Azure, Azure Gov, or Azure China.

  3. Click Getting Started.

    CloudGuard moves to Prepare.

Create a new application:

  1. Log in to the Azure management portal.

  2. Click the hamburger button and select All services.

  3. In the Search box, enter App registrations.

  4. In the App registrations window, click New registration.

  5. Enter a user-facing display name for the application, such as CloudGuard-Connect.

  6. In the Redirect URI section:

  7. Click Register.

    Azure creates the application and opens the application's page.

Enter the application details in CloudGuard:

  1. Copy the Application (client) ID and paste it into CloudGuard.

  2. In the navigation tree, click Certificates & secrets.

  3. Click New client secret.

  4. In the Add a client secret window:

    • Enter a description for the client secret

    • Create an expiry date or select one from the list

    • Click Add

      Azure creates the client secret

  5. Copy the secret Value and paste it into the CloudGuard application details Secret Key field.

    Note - Copy the secret value before you navigate away from this window.

  6. In CloudGuard, click NEXT.

    CloudGuard moves to Connect.

Enter Tenant ID and Subscription ID:

  1. Go back to All services.

  2. Select Azure Active Directory (or use the search box to find it).

  3. In the navigation tree, go to App registrations.

  4. Click on your CloudGuard application.

  5. Copy the Directory (tenant) ID.

  6. Paste the Tenant ID into the Application Details in CloudGuard.

  7. Enter Subscriptions in the Search bar.

  8. Click on your subscription.

  9. Copy your Subscription ID.

  10. Paste your Subscription ID into CloudGuard.

Add roles:

  1. In the navigation tree, select Access control (IAM).

  2. Click Add.

  3. Select Add role assignment.

  4. In the Add role assignment window:

    • Select the Reader role

    • Select the CloudGuard app you registered

    • Click Save

  5. For Manage mode, click Add.

    • Select the Network Contributor role

    • Select the CloudGuard app you registered

    • Click Save

Add permissions:

  1. Go back to All services.

  2. Select Azure Active Directory (or use the search box to find it).

  3. In the navigation tree, go to App registrations.

  4. Click on your CloudGuard app.

  5. In the navigation tree, select API permissions.

  6. Click Add a permission.

  7. In the Request API permissions window, on Microsoft APIs tab select, Microsoft Graph.

  8. Select Application permissions.

  9. In the Select permissions area, select:

    • Below Directory: Directory.Read.All

    • Below Reports: Reports.Read.All

    • Below Policy: Policy.Read.All

    • Below Access Review: AccessReview.Read.All

  10. Click Add permissions.

    The permissions update.

Grant admin consent:

  1. For your Azure Active Directory, click Grant admin consent for.

  2. Click Yes when asked to confirm.

  3. In CloudGuard, click NEXT.

  1. Enter your account Display Name.

  2. Click NEXT.

  1. Select an Organizational Unit to associate with the cloud account.

    Note - Optional step. Use the Organizational Units page in Assets to create and change associations.

  2. Click Finish.

    Onboarding starts.

Your Azure account was onboarded successfully to CloudGuard.