Azure plugin

For more information about what this plugin does and the data streams it retrieves, see:

Azure

Monitor your Azure environment, VMs, Functions, Cost and more.

To add a data source click on the + next to Data Sources on the left-hand menu in SquaredUp. Search for the data source and click on it to open the Configure data source page. Adding from data sources page

Before you start

When configuring the data source and selecting the Authentication method, you have two options to choose from - clicking the Sign-in button or entering Explicit application credentials.

Entering Explicit application credentials is highly recommended, as this option gives greater granular control over which permissions the data source uses. To enforce a "least privilege" approach, you can configure an application in Azure with only the Reader role assigned and that is restricted to certain areas of your tenant.

You may also need to configure additional permissions for your app registration, depending on the data streams you want access to.

Configuring explicit application details

1. In the Azure portal, navigate to App registrations and do one of the following:
   • If you don't have an app registration for SquaredUp, create a new one using the default options (no redirect URL is needed).
     1. Click New registration.
     2. Name:
        Enter a name for the app, for example, SquaredUp.
     3. Click Register.
   • If you already have an app registration configured for SquaredUp, select it from the list.

2. Make a note of the Application (client) ID and the Directory (tenant) ID.

3. Click Add a certificate or secret to open Certificates and secrets, then do the following:
   1. On the Client secrets tab, click New client secret.
   2. Enter a Description for the secret. For example, SquaredUp plugin.
   3. Select when the secret Expires.
   4. Click Add to create the secret and add it to the list.
   5. Make a note of the Value. For more information see Microsoft: Use the portal to create an Microsoft Entra application and service principal that can access resources.

4. Navigate to the Subscription or Resource Group that you want to integrate and view in SquaredUp, and make a note of the ID.
   1. In Access control (IAM) click Add > Add role assignments and choose the Reader role.
   2. Search for the name of the app registration you created, select it and click Review + assign.
   3. Repeat these steps to integrate multiple subscriptions and resources groups.

Configuring permissions for data streams

In order to use many of the Azure data streams you must assign permissions via the app registration you created / edited when configuring explicit application details.

Do the following in the Azure portal, depending on which data streams you want access to:

1. To use the Cost data streams:
   1. In Access control (IAM) click Add > Add role assignments and choose the Cost Management reader role.
   2. Search for the name of the app registration you created, select it and click Review + assign.
2. To use the Billings data streams:
   1. Open Cost management + Billing and select the right scope from Billing scopes.
   2. In Access control (IAM) click Add and choose the Billing account reader role.

      If you don't see billing account reader or you cannot assign it to your application then see the Enterprise agreementoption when selecting a Billing Account Type, as this advises how to assign permissions via the Azure API.

   3. Search for the name of the app registration you created, select it and click Add.
3. To use all the Savings plans and/or Reservations data streams:
   1. Open Savings plans or Reservations and select the plan you want.
   2. In Access control (IAM) click Add and choose the Billing account reader or Enrollment reader role.
   3. Search for the name of the app registration you created, select it and click Select, then Review + assign.
4. To use the Entra Application Health and Entra Application Credentials data streams you must configure your app registration to access to your Microsoft Graph APIs:
   1. Navigate to API permissions > Add a permission.
   2. Select Microsoft Graph from the Microsoft APIs section.
   3. Select Application permissions.
   4. Add one of the following permissions:
      • Directory.Read.All
      • Application.Read.All
   5. Click Add permissions.
   6. Admin consent is required for these permissions to become active. Click Grant admin consent for <your organization> .

Configuring the data source

1. Display name:
   Enter a name for your data source. This helps you to identify this data source in the list of your data sources.

2. Authentication:
   You have two options to choose from for authentication, using the Sign-in button or entering Explicit application credentials:.
   • Sign-in button Least privileged access caution:
     Allows the Azure data source instance to access Azure from the perspective of a given user account, with limited granular control over the permissions the data source runs with.
     
     After clicking the Sign in with Microsoft button you can choose to login as either an administrator or a non-administrator of the target tenant (see Microsoft: Manage consent to applications and evaluate consent requests).
     Administrator of the target tenant

     As an administrator you can either consent for just yourself or for everyone in the organization by clicking 'Consent of behalf of your organization', see User and admin consent in Microsoft Entra ID

     The Azure data source will then use this administrator's credentials. With this in mind you may choose to Restrict access to this data source.

     Non-administrator of the target tenant

     At the Approval required prompt you must enter justification for requesting access and request approval. In SquaredUp you will see an 'access_denied - (cancel)' message until an administrator approves your request.

     An administrator of the target tenant can respond to the consent request in the Azure portal > Enterprise applications > Admin consent requests see Microsoft: Review admin consent requests.

     After consent has been granted the non-administrator must return to the Azure data source configuration and click the Sign-in with Microsoft button again. This time after signing in the message Logged in as <username> will be shown.

     The Azure data source will then use this non-administrator's credentials.

   • Explicit application credentials:
     The recommended authentication method, allowing you to assign granular permissions when configuring explicit application credentials. You must enter the following for the app registration you configured in Azure:
     • Directory (tenant) ID
     • Application (client) ID
     • Client secret
3. Subscription IDs:
   Do the following depending on your chosen Authentication method:
   • Sign-in button: By default (when no Subscription ID is specified), objects are indexed from all the subscription IDs you have access to. Optionally, enter specific Subscription IDs to import so that only those specified objects are indexed.
   • Explicit application credentials: Enter the Subscription IDs to import. Enter as many as you like, but a minimum of one is required.
4. Management Group IDs:
   Do the following depending on your Authentication method:
   • Sign-in button: By default (when no Management Group ID is specified), objects are indexed from all the Management Group IDs you have access to. Optionally, enter specific Management Group IDs to import so that only those specified objects are indexed.
   • Explicit application credentials: Enter the Management Group IDs to import. Enter as many as you like, but a minimum of one is required.
5. Billing Account Type:
   Select the billing account type of your Azure instance. Choose from:
   • Microsoft Customer Agreement/Microsoft Partner Agreement/Microsoft Online Services Program: The default option. This is automated and requires no further configuration beyond granting permission to read the billing account.
   • Enterprise Agreement: This option requires you to specify a Billing Account ID and one or more Enrollment Account IDs.
     
     When using an Enterprise Agreement, you must use the Azure REST API to assign Enrollment Reader to an Azure Service Principal (SPN) OR use the Sign-in button authentication button and authenticate with an account that has been granted Enrollment Reader.
     
     As there is no user interface to assign this role to an SPN, it must be performed via the API, as described here. You can easily make requests to the Azure API using the Azure CLI.
6. Import Entra Applications:
   Select to import your Entra enterprise applications and app registrations. This gives you access to the the Entra Application Health and Entra Application Credentials data streams but requires additional permissions. See step 4 of configuring permissions for data streams.

7. Install dashboards:
   Select whether you would like to install pre-built dashboards and perspectives with the data source. By default, this is set to on.

8. (Optional) Restrict access to this data source:
   You can enable this option if you only want certain users or groups to have access to the data source, or the permission to link it to new workspaces. See data source access control for more information.

   Restrict access to this data source

   The term data source here really means data source instance. For example, a user may configure two instances of the AWS data source, one for their development environment and one for production. In that case, each data source instance has its own access control settings.

   By default, Restrict access to this data source is set to off. The data source can be viewed, edited and administered by anyone. If you would like to control who has access to this data source, switch Restrict access to this data source to on.

   Use the Restrict access to this data source dropdown to control who has access to the workspace:

   • By default, the user setting the permissions for the data source will be given Full Control and the Everyone group will be given Link to workspace permissions.
   • Tailor access to the data source, as required, by selecting individual users or user groups from the dropdown and giving them Link to workspace or Full Control permissions.
   • If the user is not available from the dropdown, you are able to invite them to the data source by typing in their email address and then clicking Add. The new user will then receive an email inviting them to create an account on SquaredUp. Once the account has been created, they will gain access to the organization.
   • At least one user or group must be given Full Control.
   • Admin users can edit the configuration, modify the Access Control List (ACL) and delete the data source, regardless of the ACL chosen.

   Access level	Permissions
   Link to workspace	User can link the data source to any workspace they have at least Editor permissions for. Data from the data source can then be viewed by anyone with any access to the workspace. User can share the data source data with anyone they want. User cannot configure the data source in any way, or delete it.
   Full Control	User can change the data source configuration, ACL, and delete the data source.

   See Access control for more information.

9. Click Test and add to validate the data source configuration. SquaredUp will now attempt to connect to SquaredUp using the provided authentication method.

   Testing outcomes

   • Testing passed – a success message will be displayed and then the configuration will be saved.
   • Testing passed with warnings – warnings will be listed and potential fixes suggested. You can still use the data source with warnings. Select Save with warnings if you believe that you can still use the data source as required with the warnings listed. Alternatively, address the issues listed and then select Rerun tests to validate the data source configuration again. If the validation now passes, click Save.
   • Testing Failed – errors will be listed and potential fixes suggested. You cannot use the data source with errors. You are able to select Save with errors if you believe that a system outside of SquaredUp is causing the error that you need to fix. Alternatively, address the issues listed and then select Rerun tests to validate the data source configuration again. If the validation now passes, click Save.

   You can edit any data source configurations at any time from Settings > Data Sources.

Next steps

Azure provider registration

For your data streams to load correctly you must ensure that the subscriptions monitored by the Azure plugin have their providers registered. If a call is made to a subscription which does not have a required provider registered, it will return a 409 Conflict error.

Refer to the Azure documentation for detailed information on registering providers in Azure.

The Azure plugin makes calls to the following providers:

• providers/Microsoft.Billing
• providers/Microsoft.BillingBenefits
• providers/Microsoft.Capacity
• providers/Microsoft.Consumption
• providers/Microsoft.CostManagement
• providers/Microsoft.Insights
• providers/microsoft.management
• providers/Microsoft.OperationalInsights
• providers/Microsoft.ResourceGraph
• providers/Microsoft.ResourceHealth
• providers/microsoft.securityinsights

Data streams

You can use these data streams to create new tiles to show data, or if there are preconfigured dashboards installed you can copy or edit those.

The following data streams are installed with this plugin.

Configurable data streams

The following data streams installed with this plugin have configurable Parameters.

Was this article helpful?