Connect Azure

Before you start

You need the Azure admin rights described below, and in Trusterio the right to manage integrations (owners and admins have it). Anybody else sees the page read-only.

Connect it

1. Open Automation and choose Connect on the Azure card. (The link opens the dialog straight away.)
2. Give it a name under What to call it, and read What to grant: every permission and what it is for.
3. Press Add it and connect with Cloud Shell. You land on the connection’s own page.

1. Press Connect Azure. Azure Cloud Shell opens; choose Bash.
2. Copy the command Trusterio shows and paste it into Cloud Shell. The script shows itself first; press q to let it run.
3. Trusterio waits for the script and connects when it has finished.
4. Then fill in Where your Azure resources run (region), for your residency record.

To cover every subscription in the tenant, add --tenant to the command: Reader is then given at the Tenant Root Group.

What it creates

• An app called “Trusterio reader” in your directory, signing in with a federated credential: there is no client secret.
• Reader on the subscription. Giving it needs Owner or User Access Administrator.
• Microsoft Graph Directory.Read.All, with admin consent from a Global Administrator or Privileged Role Administrator. Without it, the resource checks still run and the directory checks say they could not read it.

What it checks

• MFA required for admins, legacy authentication blocked, least-privilege role assignments
• Disk encryption, secure transfer on storage, SQL transparent data encryption
• Defender switched on, Log Analytics retention, Network Watcher, Key Vault purge protection

After it is connected

• Press Sync now for the first reading. The Tests tab shows each check: what it should be, what was found, and what is affected.
• New connections are read by hand until you choose a schedule: in Monitoring, on the Collection tab, pick Every hour, Every 6 hours, Daily or Weekly.
• The page says when it was last read and its health; Sync History keeps every run.

A connection marked Beta on the Automation screen has not been tried on a real account yet: its permission list is our reading of the provider’s documentation. AWS, Azure, Google Cloud and Jira have been. If a permission is wrong, tell us.

Disconnect

On the connection’s page, choose Disconnect. Reading stops and its credentials are deleted; its history, checks and evidence stay. Then remove what you created at the provider:

• Remove the Reader role assignment.
• Delete the “Trusterio reader” app registration; that also removes its federated credential and its Graph consent.