[How-To] Set Up Azure Cloud Integration in AssetSonar for Centralized Cloud Resource Visibility

Azure infrastructure changes continuously as virtual machines start and stop, disks move between workloads, networks evolve, and databases scale across subscriptions. Without a centralized inventory, IT teams can lose track of which resources exist, where they operate, and how they connect.

AssetSonar’s Azure Cloud Integration imports supported Azure resources as Configuration Items and maps their relationships in IT Graph. This gives your team a connected view of Azure compute, storage, networking, database, load-balancing, and scaling resources alongside the rest of your IT environment.

This guide walks you through creating the required Microsoft Entra ID credentials, assigning read-only Azure permissions, connecting Azure with AssetSonar, configuring resource discovery, running the sync, and reviewing imported resources and relationships.

1. Before You Begin

Before setting up the integration, make sure you have:

• Microsoft Entra ID permissions to register applications, such as:
  • Global Administrator
  • Application Administrator
  • Cloud Application Administrator
• Owner or User Access Administrator access on every Azure subscription you want AssetSonar to sync.

2. Create an App Registration in Microsoft Entra ID

Before connecting Azure with AssetSonar, create an app registration and client secret in Microsoft Entra ID. These steps will provide the three values required in AssetSonar:

• Application (Client) ID
• Directory (Tenant) ID
• Client Secret Value

AssetSonar uses these credentials to authenticate with Azure and import supported cloud resources.

To create an app registration:

1. Sign in to the Microsoft Azure Portal.
2. Go to Microsoft Entra ID → App registrations.
3. Click New registration.
4. Enter a clear name, such as AssetSonar Azure Cloud.
5. Under Supported account types, select Accounts in this organizational directory only.
6. Leave Redirect URI blank. It is not required for this integration.
7. Click Register.
8. On the app’s Overview page, copy and securely store:
   • Application (Client) ID
   • Directory (Tenant) ID

You will enter these values in AssetSonar when connecting the integration.

3. Create a Client Secret

Next, create the client secret that AssetSonar will use with the Application ID and Tenant ID.

To create a client secret:

1. Open the app registration you created.
2. Go to Certificates & secrets.
3. Under Client secrets, click New client secret.
4. Enter a description.
5. Select an expiry period.
6. Click Add.
7. Immediately copy the secret Value and store it securely.

Important:

• Copy the client secret Value, not the Secret ID.
• Azure displays the Value only once. If you lose it, you must create a new client secret.
• Record the expiry date so you can rotate the secret before it expires.

4. Create a Custom Azure RBAC Role

AssetSonar accesses Azure resources through Azure Resource Manager using read-only APIs. Create a custom RBAC role containing only the permissions required for Azure Cloud inventory synchronization.

Important: Do not assign Azure’s built-in Reader role. Use the custom role defined below.

Use the following role definition:

{

  "Name": "AssetSonar Azure Cloud Reader",

  "IsCustom": true,

  "Description": "Read-only access for AssetSonar Azure Cloud inventory sync",

  "Actions": [

    "Microsoft.Resources/subscriptions/read",

    "Microsoft.Compute/virtualMachines/read",

    "Microsoft.Compute/disks/read",

    "Microsoft.Compute/virtualMachineScaleSets/read",

    "Microsoft.Network/virtualNetworks/read",

    "Microsoft.Network/networkInterfaces/read",

    "Microsoft.Network/networkSecurityGroups/read",

    "Microsoft.Network/loadBalancers/read",

    "Microsoft.Sql/servers/read",

    "Microsoft.Sql/servers/databases/read",

    "Microsoft.Sql/managedInstances/read"

  ],

  "NotActions": [],

  "DataActions": [],

  "NotDataActions": [],

  "AssignableScopes": [

    "/subscriptions/<subscription-id>"

  ]

}

Replace <subscription-id> with the target subscription ID. To use the same custom role across multiple subscriptions, include each subscription under AssignableScopes. 

To create the custom role:

1. In the Azure Portal, open a target Subscription or management group.
2. Go to Access control (IAM) → Roles.
3. Click Add → Add custom role.
4. Enter a name, such as AssetSonar Azure Cloud Reader.
5. Add a description for the role.
6. Under Permissions, add the Actions listed above, or create the role using the JSON definition.
7. Under Assignable scopes, confirm the subscriptions where the role can be assigned.
8. Review and create the role.

5. Assign the Custom Role to the App

After creating the custom role, assign it to the app registration’s service principal on every subscription you want AssetSonar to sync.

To assign the role:

1. Open the relevant Azure subscription.
2. Go to Access control (IAM).
3. Click Add → Add role assignment.
4. Under Role, select the custom role you created, such as AssetSonar Azure Cloud Reader.
5. Under Members, select User, group, or service principal.
6. Click Select members.
7. Search for the app registration name and select it.
8. Review and assign the role.

Only enabled Azure subscriptions where the custom role is assigned to the app’s service principal will appear during synchronization.

6. Connect Azure in AssetSonar

Once you have the Application ID, Tenant ID, and Client Secret Value, use them to connect Azure with AssetSonar.

To connect the integration:

1. Go to Settings → Integrations → Mobile Device Management & Network Discovery → Azure Cloud.
2. Select Enabled.
3. Click Connect.

1. In the Azure Cloud Settings pop-up, enter:
   • Application (Client) ID
   • Directory (Tenant) ID
   • Client Secret Value
2. Click Add.

AssetSonar uses these credentials to connect with Azure and prepare your account for resource discovery.

7. Configure Azure Resources

After connecting Azure, configure the resource types AssetSonar should import.

To configure resources:

1. Go to Settings → Integrations → Mobile Device Management & Network Discovery → Azure Cloud.
2. Click Configure Resources.
3. Select the Azure resource types you want AssetSonar to sync.
4. Click Update.

Supported Azure resources include:

• Virtual Machines
• Managed Disks
• Network Interfaces
• Virtual Networks
• Subnets
• Network Security Groups
• Load Balancers
• Backend Pools
• Managed Databases
• Managed Instances
• Virtual Machine Scale Sets
• Resource Tags

AssetSonar maps Azure resources to standard cloud infrastructure Configuration Item types:

Note: Select only the resources you actively want to monitor. This keeps your cloud resource view focused and makes sync results easier to review.

8. Run or Review Azure Sync

After setup, click Sync Now to start importing the selected Azure resources into AssetSonar.

To review sync timing:

1. Return to Azure Cloud settings.
2. Check Last Synced At to see when the latest sync was completed.

AssetSonar sends sync emails to Owners and Admins when:

• Azure sync is in progress
• Azure sync is completed
• Azure sync has failed

Use the sync status and emails to confirm whether Azure resources were imported successfully or whether the integration needs attention.

9. View Imported Azure Resources

Once synchronization is complete, you can review imported resources from the Cloud Resources listing.

To view Azure resources:

1. Go to Items → Cloud Resources.
2. Click a resource to open its detail page.

Azure resources appear under the corresponding standard cloud infrastructure categories. For example:

• Azure Virtual Machines appear under Compute Instances.
• Azure Managed Disks appear under Block Volumes.

Use the Source field to distinguish Azure resources from resources imported through another cloud provider.

10. Review Azure Resource Details

Each imported resource has a detail page containing information synchronized from Azure.

Depending on the resource type, the available information may include:

• Resource name
• Azure Resource Manager ID
• Region
• State
• Provisioning state
• Size, SKU, or capacity
• Operating system
• Network configuration
• Attached storage
• Security group association
• Database status
• Resource tags

For example, an Azure Virtual Machine may show its VM size, operating system, state, attached managed disks, network interfaces, availability zone, managed identity details, and tags.

11. Review Azure Resource Relationships

AssetSonar maps supported relationships between synced Azure resources so you can understand how your cloud infrastructure is connected.

For example:

• A Virtual Machine is attached to a Managed Disk
• A Virtual Machine uses a Network Interface
• A Virtual Machine is deployed in a Virtual Network
• A Network Interface is deployed in a Subnet
• A Network Interface is secured by a Network Security Group
• A Subnet is part of a Virtual Network
• A Subnet is secured by a Network Security Group
• A Load Balancer contains Backend Pools
• A Backend Pool registers Network Interfaces
• A Managed Instance is deployed in a Subnet
• A Virtual Machine Scale Set manages Virtual Machines
• A Virtual Machine Scale Set registers in a Backend Pool

To view relationships:

1. Go to Items → Cloud Resources.
2. Open the relevant Azure resource.
3. Click the Relationships tab.

The Relationships tab shows predefined relationships fetched from Azure, such as attached disks, network interfaces, subnets, security groups, backend pools, and scale sets. 

Ready to Centralize Your Azure Cloud Visibility?

With Azure Cloud Integration, AssetSonar brings Azure compute, storage, networking, database, load-balancing, scaling, and tag data into one operational inventory. You can monitor synchronized resources, review cloud-specific details, check integration health, and use IT Graph to understand how Azure infrastructure components depend on one another.

Need help setting up Azure Cloud Integration or troubleshooting synchronization failures? Reach out to us at support@ezo.io.