Requirements and Prerequisites for Azure

For all capabilities: A single connector can handle multiple subscriptions. You must have a subscription ID to configure a connector. This subscription ID can be one of the many subscription IDs that are being onboarded to a connector.

In Azure, create or register an application using Azure Active Directory (AD). You need the following information from this application:

• Application (client) ID

• Directory (tenant) ID

• Client credentials (you can use either a certificate or a client secret)

• Subscription ID

The Connector Configuration wizard generates an Azure Resource Manager (ARM) template.

• Use the ARM template to create a custom role with the permissions required for the connector capabilities you choose to enable.

• Apply these permissions to all the resources in the subscription for the connector.

• Ensure that you have the necessary permissions in Azure to upload this template.

Connectivity requirements:

• If required, ensure that an HTTP proxy is available.

Virtual Network (VNet) considerations:

• Each VNet can belong to only one Azure connector.

• An Azure account can have multiple Azure connectors.

• An Azure connector does not require a virtual appliance.

Special requirements:

• No additional prerequisites are required to gather labels and inventory.

• A VNet must have to ingest flow logs.

• In Azure, enable storage account key access for successful integration. The storage account must be accessible from the Secure Workload cluster to pull the logs from the storage account containers. When disabled, the system fails to connect and displays an error message.

• The flow logs must use Version 2.

• Retention time can be two days (the connector pulls new flow data every minute, and two days should be enough to set right connection failures, if any).

For segmentation: Enabling segmentation requires Gather Labels to be enabled.

When you enable segmentation for a virtual network (VNet), all the existing rules are removed from the NSGs associated with subnets and the network interfaces that are a part of those subnets. Back up your existing NSG rules in the subnet and network interface before you enable segmentation in the connector.

See also Best Practices When Enforcing Segmentation Policy for Azure Inventory.

For managed Kubernetes services (AKS): If you want to enable the Kubernetes AKS option, see the requirements and prerequisites in the Managed Kubernetes Services running on Azure (AKS) section, .