.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)
- Overview
- How to connect
- Automated checks
- Useful links
DSALTA connects to Microsoft Azure using read-only API access to collect compliance evidence automatically. Data feeds into your Access accounts, Inventory and Vulnerabilities pages. Compliance checks re-run once a day at 02:00 America/New_York.
Read-only access. DSALTA never modifies, creates, or deletes resources in your Microsoft Azure environment.
What DSALTA reads
DSALTA reads your subscription’s Azure RBAC role assignments — the Azure role, the principal type (user, group or service principal) and the assignment scope — which appear on your Access page. Azure Resource Manager returns principal object IDs, so each row is identified by object ID rather than by name or email address, and every row is recorded as Active; and your Azure resources, which appear on your Inventory page; and open security findings, which appear on your Vulnerabilities page.DSALTA does not call Azure REST endpoints directly, so there are no URL paths to list here. It uses the official Azure SDK for JavaScript (the@azure/arm-* management packages), and what the connection can do is defined entirely by the read-only role you assign it in Azure.Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Microsoft Azure environment.Troubleshooting
Integration shows Disconnected
Integration shows Disconnected
There is no Reconnect button. Open Integrations → Connected, click Manage on the Microsoft Azure card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Microsoft Azure. This usually happens when API tokens expire.
Data is not syncing
Data is not syncing
Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.
Microsoft Azure offers 2 ways to connect. Create application manually is recommended — it is entirely portal-based, so there is no sign-in code to expire and you can stop and come back at any point.
- Create application manually (recommended)
- Azure PowerShell
Set DSALTA up entirely from the Azure Portal — no PowerShell and no sign-in code to expire. Register the app, create a client secret, grant Directory.Read.All, and assign the Reader role at subscription scope. You can stop and come back at any point.Before you begin
- Azure account with permission to create App Registrations
- Permission to assign Reader at subscription and grant admin consent
| Field | Where to find it | Example |
|---|---|---|
| Tenant ID | See the steps below | Ex - 123456ab-1a2b-3c45-67de-1234ab567cd8 |
| Application ID | See the steps below | Ex - 123456ab-1a2b-3c45-67de-1234ab567cd8 |
| Application Client Secret | See the steps below | — |
| Subscription ID | See the steps below | Ex - 123456ab-1a2b-3c45-67de-1234ab567cd8 |
1
Start in DSALTA
Open Integrations in the DSALTA sidebar, find Microsoft Azure, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.
2
Step 1 – Create application on Azure
DSALTA connects to your Azure account via Application. Register your application: log in to Azure console, go to Subscriptions and note the Subscription ID. Navigate to App registrations and click
New registration. Enter the name: dsalta-auditor-app. Leave supported account types as default. Click Register and note the Application ID and Directory (Tenant) ID.3
Create Client Secret and Certificate
Open the app → Certificates & secrets →
New client secret. Enter a description (e.g. DSALTA Secret). Set expiry to 24 months. Click Add. Copy and securely save the Secret Value.4
Configure API permissions
Go to API permissions →
Add a permission → Microsoft Graph → Application permissions → Directory.Read.All → Add permissions. Click Grant admin consent for Default Directory.5
Complete role setup
Navigate to Subscriptions → your subscription → Access control (IAM) →
Add role assignment → Reader → Next → Select members → search dsalta-auditor-app → Review + assign.6
Step 2 – Provide application credentials
Enter Tenant ID, Application ID, Application Client Secret, and Subscription ID. Click Connect.
DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.
If the connection is rejected. Failed to connect. Verify credentials and Reader role.The on-screen message is generic — see Connection error messages.
Automate the creation of an application in your Azure account with specific access permissions using Azure PowerShell. Creates an app named dsalta-auditor-app with Reader role and Directory.Read.All. Requires a device-code sign-in whose code expires after 15 minutes, and every script must run in the same PowerShell session.Before you begin
- Owner or Application Administrator rights to register apps, grant admin consent for Directory.Read.All, and assign Reader at subscription scope
| Field | Where to find it | Example |
|---|---|---|
| Subscription name | You can find your subscription name from Account > Subscriptions on your Azure console. | — |
1
Start in DSALTA
Open Integrations in the DSALTA sidebar, find Microsoft Azure, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.
2
Subscription
Enter the Subscription name exactly as shown in Azure Portal → Subscriptions. Scripts below are generated for this subscription.
3
1.1 Install the Microsoft Graph modules
Copy the first PowerShell code block and run it in your Azure PowerShell terminal. It installs the
Microsoft.Graph.* modules into your user profile. In Azure Cloud Shell this can take several minutes — wait for it to finish. Nothing here is time-limited.Azure Cloud Shell (PowerShell) is the easiest place to run all of these — the modules install cleanly there and you are already signed in to Azure.4
1.2 Sign in to Microsoft Graph
Open microsoft.com/devicelogin in a browser and sign in as your Azure admin account first. Then run the sign-in code block in the same PowerShell session and enter the code it prints.
The code is valid for 15 minutes, and that one window has to cover entering the code, signing in, and approving the consent screen for
Application.ReadWrite.All, Directory.Read.All and AppRoleAssignment.ReadWrite.All. If it expires, run the sign-in block again for a fresh code — nothing has been created yet, so there is nothing to clean up.If the code expires repeatedly, or the browser reports success but the terminal never returns, use the Create application manually method instead — it needs no sign-in code. A Cloud Shell session also recycles after about 20 minutes idle, which drops the session waiting for the token.
5
1.3 Create the application
Run the third code block in the same PowerShell session. It creates an application named
dsalta-auditor-app for auditing resources. If it stops with “Not signed in”, run the sign-in block again.6
1.4 Grant permissions in Azure console
Go to App registrations and search for
dsalta-auditor-app. Click on API permissions in the left navigation panel. Click Grant admin consent for Default Directory.What each permission covers. The Reader assignment in step 1.5 is what the Azure evidence collection uses: the connection test lists your resource groups, and every sync and every check on the Automated checks tab reads Azure Resource Manager through the
@azure/arm-* SDKs. The Directory.Read.All Microsoft Graph permission covers directory data — user names, account state, MFA — which the separate Microsoft Entra ID integration collects.7
1.5 Add role assignment in Azure console
- Go to Subscription in the Azure console.
- Click on Access control (IAM).
- Add a role assignment.
- Select Reader Role and click Next.
- Click on Select members.
-
Search for
dsalta-auditor-appand select it. - Click Review + Assign.
-
Refresh the role assignment list to confirm
dsalta-auditor-appis assigned.
8
1.6 Get application details and complete integration
Run the last PowerShell code block — the one that prints the credentials JSON — in the same PowerShell session. Copy the JSON object returned in the terminal and paste it into Application credentials JSON in Step 2 below.
This script also needs the Az module: it resolves your subscription with
Get-AzSubscription -SubscriptionName (which stops on error). In Azure Cloud Shell that already works. In a local PowerShell window run Install-Module Az.Accounts and Connect-AzAccount first, otherwise the script fails at the subscription lookup even though the app was created correctly.9
STEP 2 – PROVIDE APPLICATION CREDENTIALS
Paste the JSON from the “Get credentials” script only. The clientSecret must be the Secret Value (long string), not the Secret ID (UUID). Error AADSTS7000215 usually means wrong column copied, expired secret, or JSON was edited—create a new secret in Azure Portal if needed.Application credentials JSON — Example:
{ "directoryId": "0bf1f4c0-0d4c-405f-839b-b391a5ef0221", "applicationId": "4b30d3a0-1956-4cba-8f27-9f5d973ffc17", "clientSecret": "…", "subscriptionId": "e7d64070-97d7-4f21-84e2-53e3f8d97967" }The secret this script creates is valid for 12 months. Put the expiry date in your calendar: when it lapses the nightly sync starts failing, and because DSALTA has no Reconnect button the only repair is to create a new secret in Azure, disconnect the integration and connect again — which deletes the evidence and test results already collected from Azure.
DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.
If the connection is rejected. Failed to connect. Verify the credentials JSON or Tenant ID, Application ID, Client Secret, and Subscription ID.The on-screen message is generic — see Connection error messages.
Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.
| Topic | Link |
|---|---|
| Setup | Azure App Registrations |
| General | Microsoft Azure website |
| DSALTA | Connection error messages |