Onboard Azure Infrastructure Manually

To register Netskope DSPM App in Azure, follow these steps:

In your Azure portal:

1. Search Azure Active Directory > Click App registrations > New registration.

   

2. Type a Name for your App > Choose the supported account types > Click Register.

   • We recommended including Netskope DSPM in the name to make it easier to identify, but in the example we use Dasera App.

     

3. Go to the Netskope DSPM app‘s Overview > find the Application (client) ID and Directory (tenant) ID.

   

Once you’ve registered the DSPM App, continue with these steps to create a Client Secret:

In your Azure portal:

1. From the Netskope DSPM app’s Overview > Go to Certificate & secrets > Click New client secret.

2. Type a Description > Choose an expiration time.

   

3. Click Add > Copy and save the Secret Value immediately (you won’t be able to see it again later).

   

Now that you’ve created the client secret, you must define the permissions required for DSPM to operate.

All permission details documented here apply equally to:

• Manual configuration through the Azure portal
• Terraform deployments
• Troubleshooting and debugging any deployment method

In your Azure portal:

1. Go to Subscriptions > Copy the Subscription ID.

   

2. Go to Access control (IAM) > Click Add > Add custom role.

   

3. Go the JSON tab > Click Edit.

4. Replace the default JSON text with the specific role definitions below. You must add the Core Role and then any Optional Roles based on the features you want to enable.

   A. Core Permissions. (Required)

   This role helps DSPM validate assigned permissions and requested permissions for the App. It is mandatory for the integration to function.

   {
       "properties": {
           "roleName": "Netskope One DSPM Core Role",
           "description": "",
           "assignableScopes": [
               "/subscriptions/<AZURE SUBSCRIPTION ID>"
           ],
           "permissions": [
               {
                   "actions": [
                       "Microsoft.Authorization/roleAssignments/read",
                       "Microsoft.Authorization/roleDefinitions/read"
                   ],
                   "notActions": [],
                   "dataActions": [],
                   "notDataActions": []
               }
           ]
       }
   }

   

   B. Authorize & Auto-Discover Data Stores. (Optional)

   This role authorizes DSPM to automatically discover data stores in the environment.

   Actions and Purpose

   Action	Purpose
   Microsoft.Resources/subscriptions/resourceGroups/read	To discover all the resource groups in a subscription and data stores within them.
   Microsoft.Sql/servers/read	To discover and connect to SQL servers to scan databases.
   Microsoft.DBforPostgreSQL/flexibleServers/read Microsoft.DBforPostgreSQL/flexibleServers/databases/read	To discover and connect to PostgreSQL servers to scan databases.
   Microsoft.DBforMySQL/flexibleServers/read Microsoft.DBforMySQL/flexibleServers/databases/read	To discover and connect to MySQL servers to scan databases.
   Microsoft.Synapse/workspaces/read	To discover and connect to Synapse workspaces.
   Microsoft.Databricks/workspaces/read	To discover and connect to Databricks workspaces.
   Microsoft.Storage/storageAccounts/listkeys/action Microsoft.Storage/storageAccounts/read Microsoft.Storage/storageAccounts/blobServices/containers/read Microsoft.Storage/storageAccounts/fileServices/read Microsoft.Storage/storageAccounts/fileServices/shares/read	To discover all Blob storage containers and File shares present in storage accounts and scan files.
   Microsoft.Compute/disks/read	To discover all the managed disks for snapshot scan.

   Role Definition

   {
       "properties": {
           "roleName": "Netskope One DSPM Auto-Discovery Role",
           "description": "",
           "assignableScopes": [
               "/subscriptions/<AZURE SUBSCRIPTION ID>"
           ],
           "permissions": [
               {
                   "actions": [
                       "Microsoft.Resources/subscriptions/resourceGroups/read",
                       "Microsoft.Sql/servers/read",
                       "Microsoft.DBforPostgreSQL/flexibleServers/read",
                       "Microsoft.DBforPostgreSQL/flexibleServers/databases/read",
                       "Microsoft.DBforMySQL/flexibleServers/read",
                       "Microsoft.DBforMySQL/flexibleServers/databases/read",
                       "Microsoft.Synapse/workspaces/read",
                       "Microsoft.Databricks/workspaces/read",
                       "Microsoft.Storage/storageAccounts/listkeys/action",
                       "Microsoft.Storage/storageAccounts/read",
                       "Microsoft.Storage/storageAccounts/blobServices/containers/read",
                       "Microsoft.Storage/storageAccounts/fileServices/read",
                       "Microsoft.Storage/storageAccounts/fileServices/shares/read",
                       "Microsoft.Compute/disks/read"
                   ],
                   "notActions": [],
                   "dataActions": [],
                   "notDataActions": []
               }
           ]
       }
   }

   C. Authorize Data Store Snapshot Access & Unmanaged Data Store Discovery. (Optional)

   Add this role to enable snapshot-based scanning and discovery of unmanaged data stores.

   Important: To enable unmanaged data store discovery on managed disks, you must enable this capability or manually add the corresponding role permissions below.

   Actions and Purpose

   Actions	Purpose
   Microsoft.Resources/subscriptions/resourceGroups/read	To discover all the resource groups in a subscription and Managed disks within them.
   Microsoft.Resources/subscriptions/resourcegroups/write	To create a resource group for creating temporary resources required for scanning of Managed disks for detecting unmanaged data stores.
   Microsoft.Sql/servers/read Microsoft.Sql/servers/write Microsoft.Sql/servers/delete Microsoft.Sql/servers/firewallRules/write	To connect SQL servers and create a temporary SQL server for snapshot scan.
   Microsoft.Sql/servers/databases/read Microsoft.Sql/servers/databases/write	To discover all the databases on a server and create temporary cloned DBs to attach them to SQL server for snapshot scan.
   Microsoft.Compute/disks/read	To discover all the Managed disks.
   Microsoft.Compute/disks/write Microsoft.Compute/disks/delete Microsoft.Compute/disks/beginGetAccess/action	To create Managed disks for launching VM for scanning of Managed disks.
   Microsoft.Compute/virtualMachines/read Microsoft.Compute/virtualMachines/write Microsoft.Compute/virtualMachines/delete Microsoft.Compute/virtualMachines/generalize/action Microsoft.Compute/virtualMachines/start/action Microsoft.Compute/virtualMachines/deallocate/action Microsoft.Compute/virtualMachines/powerOff/action	To create VM with sidecar image for scanning of Managed disks and terminate VM after scanning.
   Microsoft.Compute/snapshots/read Microsoft.Compute/snapshots/write Microsoft.Compute/snapshots/delete	To create snapshots of Managed disks for scanning and delete after scanning.
   Microsoft.Compute/galleries/images/read Microsoft.Compute/galleries/images/versions/read	To read image gallery definitions and versions used to launch the VM for scanning Managed disks.
   Microsoft.Network/networkInterfaces/read Microsoft.Network/networkInterfaces/write Microsoft.Network/networkInterfaces/delete Microsoft.Network/networkInterfaces/join/action Microsoft.Network/publicIPAddresses/read Microsoft.Network/publicIPAddresses/write Microsoft.Network/publicIPAddresses/delete Microsoft.Network/publicIPAddresses/join/action Microsoft.Network/networkSecurityGroups/read Microsoft.Network/networkSecurityGroups/write Microsoft.Network/networkSecurityGroups/join/action Microsoft.Network/virtualNetworks/read Microsoft.Network/virtualNetworks/write Microsoft.Network/virtualNetworks/subnets/join/action	To create networking components for launching VM for scanning of Managed disks and allow Netskope One DSPM IPs to access VM for snapshot scan.

   Role Definition

   {
       "properties": {
           "roleName": "Netskope One DSPM Data Store Snapshot Role",
           "description": "",
           "assignableScopes": [
               "/subscriptions/<AZURE SUBSCRIPTION ID>"
           ],
           "permissions": [
               {
                   "actions": [
                       "Microsoft.Resources/subscriptions/resourceGroups/read",
                       "Microsoft.Resources/subscriptions/resourcegroups/write",
                       "Microsoft.Sql/servers/read",
                       "Microsoft.Sql/servers/write",
                       "Microsoft.Sql/servers/delete",
                       "Microsoft.Sql/servers/databases/read",
                       "Microsoft.Sql/servers/databases/write",
                       "Microsoft.Sql/servers/firewallRules/write",
                       "Microsoft.Compute/disks/read",
                       "Microsoft.Compute/disks/write",
                       "Microsoft.Compute/disks/delete",
                       "Microsoft.Compute/disks/beginGetAccess/action",
                       "Microsoft.Compute/virtualMachines/read",
                       "Microsoft.Compute/virtualMachines/write",
                       "Microsoft.Compute/virtualMachines/delete",
                       "Microsoft.Compute/virtualMachines/generalize/action",
                       "Microsoft.Compute/virtualMachines/start/action",
                       "Microsoft.Compute/virtualMachines/deallocate/action",
                       "Microsoft.Compute/virtualMachines/powerOff/action",
                       "Microsoft.Compute/snapshots/read",
                       "Microsoft.Compute/snapshots/write",
                       "Microsoft.Compute/snapshots/delete",
                       "Microsoft.Compute/galleries/images/read",
                       "Microsoft.Compute/galleries/images/versions/read",
                       "Microsoft.Network/networkInterfaces/read",
                       "Microsoft.Network/networkInterfaces/write",
                       "Microsoft.Network/networkInterfaces/delete",
                       "Microsoft.Network/networkInterfaces/join/action",
                       "Microsoft.Network/publicIPAddresses/read",
                       "Microsoft.Network/publicIPAddresses/write",
                       "Microsoft.Network/publicIPAddresses/delete",
                       "Microsoft.Network/publicIPAddresses/join/action",
                       "Microsoft.Network/networkSecurityGroups/read",
                       "Microsoft.Network/networkSecurityGroups/write",
                       "Microsoft.Network/networkSecurityGroups/join/action",
                       "Microsoft.Network/virtualNetworks/read",
                       "Microsoft.Network/virtualNetworks/write",
                       "Microsoft.Network/virtualNetworks/subnets/join/action"
                   ],
                   "notActions": [],
                   "dataActions": [],
                   "notDataActions": []
               }
           ]
       }
   }

5. Click Save > Review + create > Create > Ok.

Now that you’ve added the required roles, follow these steps to assign them to the Netskope DSPM App.

In your Azure portal:

1. Go to Access control (IAM) > Click Add > Select Add role assignment.

   

2. Go to the Role tab > Search the Netskope DSPM role you just created > Click Next.

   

3. Go to the Members tab > Click Select members.

4. Search the Netskope DSPM app you just created in step 1 > Click Select > Next.

5. Go to the Review + assign tab > Click Review + Assign.

   • Repeat this process for every custom role you created (Core + any Optional roles).

This permission is required for reading the role assigned to the App/service principal for validation. Follow these steps to assign it:

• In your Azure portal:

1. Go to App registrations > Open the Netskope One DSPM app.

2. Go to API permissions > Select Microsoft Graph.

3. Go to Application (1) > Mark the Application.Read.All permission > Click Update permissions.

   

4. Select Grant admin consent for Default Directory to remove the warning.

   

Now that you’ve registered the Netskope DSPM app, created the Client Secret, added the Netskope role and assigned the Netskope DSPM role, follow these steps to create the DSPM Infrastructure Connection:

1. Log into Netskope DSPM console.

2. Go to Administration > Infrastructure Connections > Azure tab.

3. Click Add Infrastructure and fill in the following fields:

   Field	Value
   Account Name	Any value (this is used to identify your infrastructure connection within the Netskope DSPM UI).
   Tenant ID	Enter the Tenant ID captured in step 3 of "Register Netskope DSPM App" section.
   Application ID	Enter the Application ID captured in step 3 of "Register Netskope DSPM App" section.
   Application Secret	Enter the Application Secret (value) captured in step 3 of "Create Client Secret" section.
   Subscription ID	Enter the Subscription ID captured in step 1 of "Add The Nestkope DSPM Role" section.

   (Tenant Onboarding Only) Auto-Discover New Subscriptions:
   If you are onboarding at the Tenant level (leaving the Subscription ID optional or providing a Root Management Group), Netskope DSPM enables Auto-Discover New Subscriptions. This capability automatically detects and onboards new subscriptions as they are added to your Azure Tenant, applying the permissions you configured in Step 3.

4. Click Acknowledge.

Netskope DSPM will then verify the connection, onboard your project(s), and begin discovering data stores.