Set Up Your Azure Subscription for Prisma Cloud

Locate and copy your Azure subscription ID.
Prisma Cloud requires the
Subscription ID
so that it can identify your Azure cloud account and can retrieve the storage account and key vault information.
Log in to Microsoft Azure, select

All services

Subscriptions

, select your subscription, and copy the

Subscription ID

.


Add Prisma Cloud as a new application on Azure Active Directory.
Registering Prisma Cloud as an application on Azure AD generates an Application ID. You need this ID and an Application key to authenticate Prisma Cloud on Azure and to maintain a secure connection.
Log in to Microsoft Azure and select

Azure Active Directory

App registrations

New application registration

.



Enter a

Name

to identify the Prisma Cloud application, select the

Supported account types

that can use the application as

Accounts in this organizational directory only

, enter your login URL for Prisma Cloud as the

Redirect URI

, and then click

Register

.

The log in URL for Prisma Cloud is the URL you received in your order confirmation email, and it varies depending on your region.



Generate a client secret for the Prisma Cloud application.

The client secret is the application password for Prisma Cloud.

Select

Azure Active Directory

App Registrations

All Applications

and select the Prisma Cloud application.

Add a client secret or the application password (

Certificates & Secrets

New client secret

).

Enter a

Description

and select a

Duration

, which is the term for which the key is valid.

Add

the new client secret and then copy the value of that new client secret for your records because you cannot view this key after you close this dialog. You will need this new client secret application key when you Add an Azure Subscription on Prisma Cloud.


Copy the information on the Prisma Cloud application from Azure Active Directory.
For Prisma Cloud to interact with the Azure APIs and collect information on your Azure resources, you must capture the following values.
Select

Azure Active Directory

App Registrations

All Applications

, find the Prisma Cloud application you created, and copy the

Directory ID

.



Select

Azure Active Directory

Enterprise Applications

.

Select your Prisma Cloud application

Properties

and copy the

Application ID

and

Object ID

.

You must enter the Object ID as the Service Principal ID in the next step.

Make sure that you get the Object ID for the Prisma Cloud application from

Enterprise Applications

All applications

on the Azure portal—not from

App Registrations

.


Grant permissions for the Prisma Cloud application to access information at the Azure Subscription level.
To assign roles, you must have Owner or User Access Administrator privileges on your Azure Subscription.
Select

All Services

Subscriptions

.

Select your subscription and

Add role assignment

(

Access Control (IAM)

).



Select the

Role

, verify that Azure AD user, group, or service principal is selected (

Assign access to

), and select the Prisma Cluod app to assign the roles.

Review the Azure Cloud Account Onboarding Checklist for a description of the roles and permissions that are required at the subscription level. Then decide which roles you must add for your security and monitoring needs—

Reader Role

,

Reader and Data Access Role

, Create a Custom Role on Azure to Enable Prisma Cloud to Access Flow Logs,

Network Contributor Role

, or

Storage Account Contributor Role

.


(
Optional
) Grant permission for the Prisma Cloud application to access the Azure Key Vault service.
If you use Azure Key Vault to safeguard and manage cryptographic keys and secrets used by your cloud applications and services, Prisma Cloud needs permission to ingest this key vault data.
From Azure, select

All Services

Key Vaults

.

Select your Key vault name and

Access Policies

.



Select

(add) your Prisma Cloud application (

Add new

Select Principal

).



Select

List

for

Key permissions

and for

Secret permissions

, select both

List

and

List Certificate Authorities

for

Certification permissions

, and then click

OK

.


(
Optional
) Grant permission for the Prisma Cloud application to access the catalog related information on Azure Data Lake Analytics account.
each Azure Data Lake Analytics account you must assign the Prisma Cloud role to access catalog related information such as ACLs, databases, credentials, external data sources, so that it can ingest metadata.After you assign these permissions to the Azure Data Lake Storage Gen 1 instance if you use the same instance in other Azure Data Lake Analytics accounts, then you do not need to repeat these steps.
On the Azure portal, go to your Data Lake Analytics account.

Select Add user wizard.

Select User, and search for the Prisma Cloud app and select it.

In the role drop down, choose Reader and click Next

Under Scope, Assign only Read only permissions and click Next to assign permissions to the files and folders.

Select the checkboxes in the Read and Execute columns, and clear the Write column, then click Next.



Verify the tasks and click Run.


On the Azure portal, Enable Network Watcher and register Insights provider.
On the Azure portal,Create a storage account on Azure for NSG flow logs.
Your Azure storage account stores the flow logs that are required for Prisma Cloud to monitor and analyze network traffic. When Prisma Cloud ingests the data in these logs, you can interact with the information in Prisma Cloud. For example, you can run queries against the data, visualize network topology, and investigate traffic flows between two instances. You can also apply network policies to this traffic.
If you do not have regulatory guidelines that specify a log retention period to which you must adhere, we recommend you set retention to at least 15 days.
On the Azure portal,Enable NSG flow logs.
Configure Prisma Cloud Reader and Data Access role for your Azure storage account.
To ingest Azure flow logs, you have to grant access to the storage account in which the logs are stored. The Reader and Data Access role provides the ability to view everything and allows read/write access to all data contained in a storage account using the associated storage account keys. If your flow logs are stored in storage accounts that belong to one or more subscriptions that are not monitored by Prisma Cloud, you must configure the Prisma Cloud application with the Reader and Data Access role for each storage account.
After creating your storage account, select

Access control (IAM)

Add role assignment

.



Select

Reader and Data Access

as the

Role

,

Select

the administrative user to whom you want to assign the role, and

Save

your changes.


Add an Azure Subscription on Prisma Cloud.