Microsoft Azure

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Microsoft Azure using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules. Compliance checks re-run once a day at 02:00 America/New_York.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Microsoft Azure environment.

What DSALTA reads

DSALTA reads your subscription’s Azure RBAC role assignments — the Azure role, the principal type (user, group or service principal) and the assignment scope — which appear on your Access page. Azure Resource Manager returns principal object IDs, so each row is identified by object ID rather than by name or email address, and every row is recorded as Active; and your Azure resources, which appear on your Inventory page; and open security findings, which appear on your Vulnerabilities page.DSALTA does not call Azure REST endpoints directly, so there are no URL paths to list here. It uses the official Azure SDK for JavaScript (the @azure/arm-* management packages), and what the connection can do is defined entirely by the read-only role you assign it in Azure.Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Microsoft Azure environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Microsoft Azure card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Microsoft Azure. This usually happens when API tokens expire.

Data is not syncing

Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

Microsoft Azure offers 2 ways to connect. Azure PowerShell is recommended.

Azure PowerShell (recommended)
Create application manually

Automate the creation of an application in your Azure account with specific access permissions using Azure PowerShell. Creates an app named dsalta-auditor-app with Reader role and Directory.Read.All.Before you begin

Owner or Application Administrator rights to register apps, grant admin consent for Directory.Read.All, and assign Reader at subscription scope

You will need:

Field	Where to find it	Example
Subscription name	You can find your subscription name from Account > Subscriptions on your Azure console.	—

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Microsoft Azure, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Subscription

Enter the Subscription name exactly as shown in Azure Portal → Subscriptions. Scripts below are generated for this subscription.

1.1 Run PowerShell code in Azure

Copy the provided PowerShell code. Execute it in your Azure PowerShell terminal. This code creates an application named dsalta-auditor-app for auditing resources.The script runs on Microsoft Graph PowerShell: it installs the Microsoft.Graph.* modules into your user profile and then calls Connect-MgGraph -Scopes "Application.ReadWrite.All","Directory.Read.All","AppRoleAssignment.ReadWrite.All". Expect a sign-in prompt and consent screen for those three delegated permissions before anything is created. Azure Cloud Shell (PowerShell) is the easiest place to run it — the modules install cleanly there and you are already signed in.

1.2 Grant permissions in Azure console

Go to App registrations and search for dsalta-auditor-app. Click on API permissions in the left navigation panel. Click Grant admin consent for Default Directory.

What each permission covers. The Reader assignment in step 1.3 is what the Azure evidence collection uses: the connection test lists your resource groups, and every sync and every check on the Automated checks tab reads Azure Resource Manager through the @azure/arm-* SDKs. The Directory.Read.All Microsoft Graph permission covers directory data — user names, account state, MFA — which the separate Microsoft Entra ID integration collects.

1.3 Add role assignment in Azure console

Go to Subscription in the Azure console.
Click on Access control (IAM).
Add a role assignment.
Select Reader Role and click Next.
Click on Select members.
Search for dsalta-auditor-app and select it.
Click Review + Assign.
Refresh the role assignment list to confirm dsalta-auditor-app is assigned.

1.4 Get application details and complete integration

Copy and run the second PowerShell code (the second code block in the connect panel — the one that prints the credentials JSON) in the same PowerShell session. Copy the JSON object returned in the terminal and paste it into Application credentials JSON in Step 2 below.

This second script also needs the Az module: it resolves your subscription with Get-AzSubscription -SubscriptionName (which stops on error). In Azure Cloud Shell that already works. In a local PowerShell window run Install-Module Az.Accounts and Connect-AzAccount first, otherwise the script fails at the subscription lookup even though the app was created correctly.

STEP 2 – PROVIDE APPLICATION CREDENTIALS

Paste the JSON from the “Get credentials” script only. The clientSecret must be the Secret Value (long string), not the Secret ID (UUID). Error AADSTS7000215 usually means wrong column copied, expired secret, or JSON was edited—create a new secret in Azure Portal if needed.Application credentials JSON — Example:

{                  "directoryId": "0bf1f4c0-0d4c-405f-839b-b391a5ef0221",                  "applicationId": "4b30d3a0-1956-4cba-8f27-9f5d973ffc17",                  "clientSecret": "…",                  "subscriptionId": "e7d64070-97d7-4f21-84e2-53e3f8d97967"                 }

The secret this script creates is valid for 12 months. Put the expiry date in your calendar: when it lapses the nightly sync starts failing, and because DSALTA has no Reconnect button the only repair is to create a new secret in Azure, disconnect the integration and connect again — which deletes the evidence and test results already collected from Azure.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Failed to connect. Verify the credentials JSON or Tenant ID, Application ID, Client Secret, and Subscription ID.The on-screen message is generic — see Connection error messages.

Configure the role manually with the appropriate policies and permissions to ensure that DSALTA can access your cloud resources. Register the app, create client secret, set API permissions (Directory.Read.All), and assign Reader role at subscription.Before you begin

Azure account with permission to create App Registrations
Permission to assign Reader at subscription and grant admin consent

You will need:

Field	Where to find it	Example
Tenant ID	See the steps below	`Ex - 123456ab-1a2b-3c45-67de-1234ab567cd8`
Application ID	See the steps below	`Ex - 123456ab-1a2b-3c45-67de-1234ab567cd8`
Application Client Secret	See the steps below	—
Subscription ID	See the steps below	`Ex - 123456ab-1a2b-3c45-67de-1234ab567cd8`

Start in DSALTA

Step 1 – Create application on Azure

DSALTA connects to your Azure account via Application. Register your application: log in to Azure console, go to Subscriptions and note the Subscription ID. Navigate to App registrations and click New registration. Enter the name: dsalta-auditor-app. Leave supported account types as default. Click Register and note the Application ID and Directory (Tenant) ID.

Create Client Secret and Certificate

Open the app → Certificates & secrets → New client secret. Enter a description (e.g. DSALTA Secret). Set expiry to 24 months. Click Add. Copy and securely save the Secret Value.

Configure API permissions

Go to API permissions → Add a permission → Microsoft Graph → Application permissions → Directory.Read.All → Add permissions. Click Grant admin consent for Default Directory.

Complete role setup

Navigate to Subscriptions → your subscription → Access control (IAM) → Add role assignment → Reader → Next → Select members → search dsalta-auditor-app → Review + assign.

Step 2 – Provide application credentials

Enter Tenant ID, Application ID, Application Client Secret, and Subscription ID. Click Connect.

If the connection is rejected. Failed to connect. Verify credentials and Reader role.The on-screen message is generic — see Connection error messages.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
Infra entity should be classified	Medium	Infrastructure entities should have classification.
Azure should be on https	High	HTTPS should be enforced for endpoints.
Azure should redirect http to https	High	HTTP traffic should redirect to HTTPS.
Azure flow logs should be captured	Medium	Network flow logs should be enabled.
Azure virtual network flow logs should be captured	Medium	VNet flow logs should be captured.
Azure activity logs should be archived	High	Activity logs should be archived to storage.
Azure Defender should be enabled	High	Microsoft Defender for Cloud should be enabled.
Reported incident should be closed in Microsoft defender	Medium	Open Defender incidents should be resolved.
Azure CosmosDB should be encrypted	High	Cosmos DB accounts should use encryption.
Azure CosmosDB backup should be enabled	High	Cosmos DB backup should be enabled.
Azure CosmosDB latency should be monitored	Medium	Cosmos DB latency should be monitored.
Azure CosmosDB database should be protected from direct internet traffic	High	Cosmos DB should not allow direct public internet.
Azure VM should be protected from direct internet traffic	High	VMs should not be directly exposed to internet.
Azure VM CPU utilization should be monitored	Medium	VM CPU should be monitored.
Azure SQL database should be encrypted	High	SQL databases should use encryption.
Azure SQL database should be protected from direct internet traffic	High	SQL should not allow direct public access.
Azure SQL database backup should be enabled	High	SQL backup should be enabled.
Azure SQL database memory utilization monitored	Medium	SQL memory should be monitored.
Azure SQL database CPU utilization should be monitored	Medium	SQL CPU should be monitored.
Azure SQL database IO utilization should be monitored	Medium	SQL IO should be monitored.
Azure storage account should be encrypted	High	Storage accounts should use encryption.
Azure storage account public network access should be disabled	High	Public network access should be disabled where appropriate.
Azure storage account Minimum TLS version should be version 1.2	High	Storage should require TLS 1.2 minimum.
Azure storage account secure transfer required should be enabled	High	Secure transfer (HTTPS) required.
Azure storage account default network access rule should set to deny	High	Default action should be deny.
Azure storage account cross tenant replication should not be enabled	Medium	Cross-tenant replication should not be enabled.
Azure storage account allow blob anonymous access should be disabled	High	Anonymous blob access should be disabled.
Azure Web App is using the latest version of TLS encryption	High	Web App should use latest TLS.
Azure Web App Redirects All HTTP traffic to HTTPS in Azure App Service	High	Web App should redirect HTTP to HTTPS.
Azure RBAC Key Vault should have expiration set for all keys	Medium	Keys in RBAC Key Vault should have expiration.
Azure Non RBAC Key Vault should have expiration set for all keys	Medium	Keys in non-RBAC Key Vault should have expiration.
Azure Key Vault should be recoverable	High	Soft delete and purge protection.
Azure postgreSQL Database Server enforce SSL connection should be enabled	High	PostgreSQL should enforce SSL.
Azure postgreSQL Database Server Infrastructure double encryption should be enabled	Medium	Infrastructure double encryption for PostgreSQL.
Azure Cache for Redis CPU utilization should be monitored	Medium	Redis CPU should be monitored.
Azure Cache for Redis freeable memory should be monitored	Medium	Redis memory should be monitored.
Azure Cache for Redis client connections should be monitored	Medium	Redis connections monitored.
Azure Databricks workspace should be encrypted	High	Databricks workspace encryption.
Azure Databricks health should be monitored	Medium	Databricks health monitoring.
Azure Databricks CPU utilization should be monitored	Medium	Databricks CPU monitored.
Azure Databricks workspace backup should be enabled	High	Databricks backup enabled.
Azure Disk should be encrypted	High	Managed disks should be encrypted.
Azure Disk backup should be enabled	Medium	Disk backup enabled.
Azure Load Balancer health probe status should be monitored	Medium	Load balancer health monitored.
Azure Application Gateway healthy host count should be monitored	Medium	App Gateway healthy host count monitored.
Azure Front Door Origin health should be monitored	Medium	Front Door origin health monitored.
Azure AKS node CPU utilization should be monitored	Medium	AKS node CPU monitored.
Azure AKS node memory working set usage should be monitored	Medium	AKS node memory monitored.
Azure access should be removed for offboarded user	High	Offboarded users should not have access.

Topic	Link
Setup	Azure App Registrations
General	Microsoft Azure website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting