Configure Cloud Storage on Microsoft Azure for Panorama

Log into the Microsoft Azure portal as an administrator.
Administrator level privileges are required to successfully add the Enterprise DLP evidence storage application using Cloud Shell and to configure access to the storage account to enable file uploads by the DLP cloud service to save files for evidence analysis.
(
Optional
) From the portal menu, select
Storage groups
and
Create
a new storage group.
You can also search for
storage groups
.
The storage group is required to associate the storage account you create next for storing matched files.
Skip this step if you have an existing resource group that you want to associate with the storage account.
From the portal menu, select
Storage accounts
and
Create
a new storage account.
You can also search for
storage accounts
.
Obtain the App ID, Tenant ID, and blob service endpoint URL.
This information is required to add the Palo Alto Networks Enterprise DLP application to your Microsoft Azure tenant and to configure connectivity to the DLP cloud service.
Palo Alto Networks Enterprise DLP App ID
- 65def4b7-bae6-4bff-ab73-63fe8c9a3c8d
The Palo Alto Networks Enterprise DLP app ID can be found in the DLP app on the hub (
Settings
Sensitive Data
Configure Bucket
Azure
).
Obtain your Tenant ID.
From the portal menu, select
Azure Active Directory
.
You can also search for
azure active directory
.
In the Basic Information section, copy the
Tenant ID
.
Obtain the blob service endpoint URL.
From the portal menu, select
Storage accounts
and select the storage account you will use to save files for evidence analysis.
Select
Settings
Endpoints
and copy the
Block service
endpoint URL.
Add the Palo Alto Networks Enterprise DLP application.
Open
Cloud Shell
.
Click the Cloud Shell icon located in the top-right corner of the Microsoft Azure portal.
Add the Palo Alto Networks Enterprise DLP application.
Connect-AzureAD -TenantID <Your_Tenant_ID>
New-AzureADServicePrincipal -AppId 65def4b7-bae6-4bff-ab73-63fe8c9a3c8d
It may take a few minutes for Microsoft Azure to add a new application to your Azure tenant.
Close the Cloud Shell.
Search for and select
Enterprise applications
.
For the Application type, select
All applications
.
Search for the
Palo Alto Networks Enterprise DLP
application name to verify you successfully added the application.
Configure permissions for the Palo Alto Networks Enterprise DLP application.
Select the
Palo Alto Networks Enterprise DLP
application name.
Select
Security
Permissions
and
Grant Admin consent
.
Select the administrator email in the Microsoft login prompt that is displayed.
Accept
the permissions request to allow the Palo Alto Networks Enterprise DLP application to view your Azure storage accounts .
It may take a few minutes for the permissions to be successfully granted to the Palo Alto Networks Enterprise DLP application.
You still need to grant the Palo Alto Networks Enterprise DLP application permission to write to a specific storage account.
Verify that the
Azure Storage
and
Microsoft Graph
API names are displayed in the Admin consent section.

From the portal menu, select
Storage accounts
and select the storage account you want to use to save files for evidence analysis.
Select
Access Control (IAM)
Add
Add Role Assignment
Storage Blob Data Owner
and click
Next
.
Select to assign access to
User, group, or service principle
and
select members
.
Search and select the
Palo Alto Networks Enterprise DLP
application and
Select
the application.
Review + assign
to allow the Palo Alto Networks Enterprise DLP application to write to the storage account.
It can take up to 10 minutes for the write permissions to be successfully granted to the Palo Alto Networks Enterprise DLP application.
Configure the storage bucket for evidence file storage.
Log in to the DLP app on the hub.
If you do not already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.
Access to evidence storage settings and files on the hub is allowed only for an account administrator or app administrator roles with a valid Enterprise DLP license associated with that support account. This is to ensure that only the appropriate users have access to report data and evidence.
Select
Settings
Sensitive Data
and select
Configure Bucket
Azure
as the Public Cloud Storage Bucket.
Select
Input Bucket Details
.
Enter Microsoft Azure Tenant ID.
Enter the Storage Endpoint.
This is the blob service endpoint URL that you gathered for the storage account.
Connect
the storage account and the DLP cloud service.

View the
Connection Status
to verify that the DLP cloud service successfully connected to the storage account.
Save
if the DLP app can successfully connect to your resource group. A
connectiontest
file is uploaded to your storage account by the DLP cloud service to verify connectivity.
If the DLP app cannot successfully connect to your resource group, select
Previous
and edit the connection settings.
In the DLP
Settings
,
Enable for NGFW
to enable evidence storage for Next-Gen firewalls and Prisma Access (Panorama Managed).
You can also
Enable for Prisma Access
from the DLP app if you are leveraging Enterprise DLP on Prisma Access (Cloud Managed).
You can only enable storage of sensitive files for platform for which you have activated the Enterprise DLP license. For example, you only have the option to enable evidence storage for Next-Generation Firewalls if you activated the Enterprise DLP license on Panorama.
Download Files for Evidence Analysis on Panorama.