>
    Strata Copilot
    Create a Microsoft Azure Application Gateway Machine
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Welcome to Installations
    6. About Machines
    7. Create a New Machine
    8. Create a Microsoft Azure Application Gateway Machine
    Next‑Gen Trust Security

    Create a Microsoft Azure Application Gateway Machine

    Table of Contents

    Create a Microsoft Azure Application Gateway Machine

    Creating a machine enables Next-Gen Trust Security to connect to Microsoft Azure Application Gateway so certificates can be provisioned to the gateway's HTTPS listeners. After creating the machine, you can provision certificates to it.

    Before You Begin

    • An Azure subscription that contains the Application Gateways you want to manage.
    • A Microsoft Entra ID (Azure AD) service principal with a client secret. The connector authenticates as this service principal.
    • The Network Contributor role assigned to the service principal, scoped to the subscription or to the resource group that contains the target Application Gateways. This role grants both the read and write permissions on Microsoft.Network/applicationGateways that the connector requires.
    • The service principal's Tenant ID, Client ID, and Client Secret, and the Subscription ID.
      Tip: To create the service principal in the Azure portal, go to Microsoft Entra ID > App registrations > New registration and record the application (client) ID. Then go to Certificates & secrets > New client secret and record the secret value, which is shown only once. Assign the role from Subscriptions > your subscription > Access control (IAM) > Add role assignment.
    1. Enter the Tenant ID. This is the Microsoft Entra (Azure AD) tenant ID.
      Note: The Tenant ID, Client ID, and Subscription ID must each be a valid UUID: 32 hexadecimal characters with four hyphens.
    2. Enter the Client ID. This is the application (client) ID of the service principal.
    3. Enter the Client Secret. This is the client secret for the service principal.
      Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
    4. Enter the Subscription ID. This is the Azure subscription ID that contains the Application Gateways.
    5. Click Test Access to verify connectivity.
      Note: The test succeeds when the credentials are valid and the service principal can list Application Gateways. A subscription that contains no Application Gateways still passes the test.
    6. Click Continue. The Continue button is enabled only after the connection test succeeds.

    What's Next?

    © 2026 Palo Alto Networks, Inc. All rights reserved.