Before you begin
Note: To create a Microsoft Azure Application Registration machine, you must have the Superuser role.
You will need the following information to complete this procedure:
Tenant ID
Client ID
Client secret
Credentials: Choose between user credentials or shared credentials.
At least one active VSatellite
CyberArk permissions for Azure: You must specify these permissions when defining the role's permission policy.
Before creating the machine in Next-Gen Trust Security, you must configure the Azure Application Registration with the required permissions:
Create an Application Registration in your Azure portal.
Create a Client Secret for the application registration. This secret will be used for authentication in the Next-Gen Trust Security connector.
Add the required API permission:
Navigate to API permissions in your application registration.
Click Add a permission > Microsoft Graph > Application permissions.
Add the Application.Read.All permission.
Grant admin consent for the tenant to activate the permission.
Important: The Application.Read.All permission is required for Next-Gen Trust Security to query application credentials. If this permission is not granted, the connection test will fail with an “Insufficient privileges to complete the operation” error.
Enter the Tenant ID.
Select a Credential Type.
Enter the Client ID.
Enter the Client Secret.
Click Test Access, then click Continue.Continue is available only after a successful test.
Note: If Test Access fails, verify that the client secret value (not the secret ID) is entered and ensure the Azure Application Registration has sufficient permissions.
