Azure VMs (WIP)
Enumerates the subscriptions a service principal can see and imports their virtual machines, resolving each one's networking through its interfaces, public IPs and virtual networks.
| Type name | azure_assets |
| Creates | Endpoints |
| Runs on | A sensor with outbound reach to management.azure.com |
| Presence flag | azure_exists |
| Field prefix | azure_ |
What it contributes
Unlike the directory- and agent-based sources, this one reports infrastructure — what exists in the subscription, whether or not anything is installed on it.
- Resource identity — resource ID, subscription ID, location, time created
- Sizing and state — VM size, hardware profile size, VM status, provisioning state, hibernation capability
- Networking — private IP, public IP, MAC, hostname, subnet, network interface IDs
- Image — publisher, offer, SKU, version and exact version of the source image
- OS disk — OS type, disk name, create option, caching
- OS profile — computer name, admin username, Linux SSH public key data
- Security profile — security type, secure boot enabled, vTPM enabled
It writes the shared fields names, os, os_vendor, type, mac,
private_ip, last_public_ip and updated_at.
A VM with no EDR agent, no directory join and no Nessus agent is invisible to
every other integration but present here. Comparing azure_exists against
cs_exits or defender_exits is a direct agent-coverage report for your Azure
estate.
Requirements
The integration is outbound-only: it reads Azure Resource Manager on a schedule, so nothing is installed in the subscription, nothing runs inside the VMs, and nothing has to reach into the deployment.
Network access
| From | To | Protocol | Port |
|---|---|---|---|
| The sensor running the integration | login.microsoftonline.com — the token endpoint | HTTPS over TCP | 443 |
| The sensor running the integration | management.azure.com — Azure Resource Manager | HTTPS over TCP | 443 |
Two hosts, because authentication and data live in different services: the run takes a client-credentials token from the first, then reads subscriptions, virtual machines, NICs, public IPs and virtual networks from the second. If the sensor reaches the internet through a proxy, point Proxy settings at it rather than opening direct egress.
Access in Azure
| Need | Why |
|---|---|
| An account that can create a service principal | The credential is an app registration with a client secret |
| An account that can assign Azure RBAC roles at the intended scope | This integration uses Resource Manager, so access is a Reader role assignment rather than a consented Graph permission — assigning it needs Owner or User Access Administrator at that scope. See Permissions in Azure |
Reader on a management group rather than per subscription is the assignment that keeps coverage correct as subscriptions are added — the warning under Permissions in Azure explains why.
In this deployment
| Need | Why |
|---|---|
| A registered, healthy sensor | The integration runs on a sensor, on the platform's schedule — see Sensors |
There are no special host requirements beyond a sensor that is checking in. The call count scales with the number of subscriptions and VMs, not with anything on the sensor host.
Configuration
| Field | Required | Notes |
|---|---|---|
| Name | Yes | Label for this instance |
| Tenant ID | Yes | Entra tenant ID |
| Client ID | Yes | Service principal client ID |
| Client secret | Yes | Service principal secret |
| Proxy settings | No | http://host:port |
| Sensor | Yes | Sensor that will run the integration |
Its Ignore if host is offline default is 180 days rather than the usual platform default, because a stopped-deallocated VM legitimately goes months without changing.
Permissions in Azure
This integration uses Azure Resource Manager, not Graph, so its permissions are Azure RBAC role assignments rather than app permissions:
| Scope | Role |
|---|---|
| Each subscription to be discovered | Reader |
It authenticates for the https://management.azure.com/.default scope and then
reads, per subscription: /providers/Microsoft.Compute/virtualMachines,
/providers/Microsoft.Network/networkInterfaces,
/providers/Microsoft.Network/publicIPAddresses and
/providers/Microsoft.Network/virtualNetworks.
The integration discovers only the subscriptions the service principal is assigned on. A subscription created later, or one assigned to a different management group, silently will not appear. Assign Reader at the management group covering everything you want inventoried, and re-check after tenant reorganisations.
See also
- Azure managed devices — directory objects rather than infrastructure
- Integrations overview — the shared configuration model