Azure

​

How It Works

1. Permissions
   • Azure Portal
   • Azure CLI

   a. Register an application

   1. Sign in to the Azure Portal and search for Microsoft Entra ID.
   2. In the left menu open Manage → App registrations.
   3. Click + New registration, give it a name (e.g. codeant-cspm), leave the defaults, and click Register.

   b. Create a client secret

   1. In the app registration’s left menu, open Manage → Certificates & secrets.
   2. Click + New client secret, set an expiry, and click Add. Copy the secret Value immediately - it is only shown once.

   c. Grant Microsoft Graph permissions

   1. In the app registration’s left menu, open Manage → API permissions.
   2. Click + Add a permission, choose Microsoft Graph, then Application permissions.
   3. Search for and tick: AuditLog.Read.All, Directory.Read.All, Policy.Read.All. Click Add permissions.
   4. Click Grant admin consent for <tenant>, then Yes. Each permission’s status should turn green.

   d. Assign the Reader role on the subscription

   1. In the Azure Portal top search bar, type Subscriptions and click the first plain Subscriptions result under Services (not Billing subscriptions or the Resource Manager variant).
   2. From the list, click the subscription you want CodeAnt to scan. (If you have many subscriptions, repeat this step for each one.)
   3. In the left menu of the subscription blade, click Access control (IAM).
   4. Click + Add at the top of the page, then choose Add role assignment from the dropdown.
   5. On the Role tab, search for Reader, select the Reader row, and click Next.
   6. On the Members tab, leave Assign access to as User, group, or service principal, then click + Select members.
   7. In the Select members panel on the right, type codeant-cspm (or the exact name you used in step a.3) into the search box, click the matching application in the results, and click Select at the bottom.
   8. Click Next until you reach the Review + assign tab, then click Review + assign to commit.

   e. Collect the credentialsFrom the app registration Overview page copy the Application (client) ID and Directory (tenant) ID. Use these together with the client secret from step b in the next section. (The Subscription ID, found on the subscription’s Overview page, isn’t part of the saved credential - it’s only used for the optional validation probe in step 2.)

   • Get the tenant ID
     az account show --query tenantId -o tsv
     
   • Get the client (app) ID
     az ad app list --display-name "codeant-cspm" --query "[0].appId" -o tsv
     
   • Create (or reset) a client secret
     az ad app credential reset \
       --id YOUR_APP_ID \
       --append \
       --credential-description "exporter-script" \
       --years 1 \
       --query password -o tsv
     
     • This command outputs the new secret.
   • Get the subscription ID (the one you want CodeAnt to scan)
     az account show --query id -o tsv
     
   • Ensure the SP has Reader rights
     az role assignment create \
       --assignee YOUR_APP_ID \
       --role Reader \
       --scope "/subscriptions/YOUR_SUBSCRIPTION_ID"
     
   • Grant Microsoft Graph application permissions (AuditLog.Read.All, Directory.Read.All, Policy.Read.All)
     GRAPH_APP_ID=00000003-0000-0000-c000-000000000000
     
     az ad app permission add --id YOUR_APP_ID --api $GRAPH_APP_ID \
       --api-permissions \
         b0afded3-3588-46d8-8b3d-9842eff778da=Role \
         7ab1d382-f21e-4acd-a863-ba3e13f7da61=Role \
         246dd0d5-5bd0-4def-940b-0421030a5b68=Role
     
     az ad app permission admin-consent --id YOUR_APP_ID
     
     • The three GUIDs are the well-known role IDs for AuditLog.Read.All, Directory.Read.All, and Policy.Read.All on Microsoft Graph. Admin consent requires a Global Administrator (or Privileged Role Administrator) signed in.
2. Settings
   • In the CodeAnt UI navigate to Settings → Cloud Security → Azure.
   • Under Azure Credentials, fill in Directory (tenant) ID, Application (client) ID, and Azure Client Secret, then click Save in the top right.
   • (Optional) Under Validate against subscription, paste a Subscription ID and click Validate to confirm the service principal can read that subscription. A green confirmation means the Reader role is assigned and resources are listable; it does not test the Graph permissions, so make sure admin consent in step 1c really turned green. The Subscription ID is not stored - it is only used for this probe.
   • 
3. Start a Scan
   • Go to Cloud Security -> Start a New Scan and pick your Azure connection.
   • Within 15-20 minutes, the scan will be completed, and you will see the results.

​

Optional: cover two extra App Service checks

1. On the subscription’s Access control (IAM) page choose + Add → Add custom role, pick Start from JSON, and upload this file with your subscription ID filled in:

{
  "properties": {
    "roleName": "CodeAntExtraRead",
    "description": "Read-only actions not covered by Reader, used by two App Service checks.",
    "assignableScopes": ["/subscriptions/<your-subscription-id>"],
    "permissions": [
      {
        "actions": [
          "Microsoft.Web/sites/host/listkeys/action",
          "Microsoft.Web/sites/config/list/Action"
        ],
        "notActions": [],
        "dataActions": [],
        "notDataActions": []
      }
    ]
  }
}

2. Assign the new role to codeant-cspm the same way as Reader.

​

VM Scanning permissions

az role assignment create \
  --assignee YOUR_APP_ID \
  --role "Disk Snapshot Contributor" \
  --scope "/subscriptions/YOUR_SUBSCRIPTION_ID"