Step 1/3: Configure a Microsoft Entra ID Application for CSA

To configure Azure for Continuous Security Assessment (CSA), you must log in to the Azure portal as a subscription owner or global administrator and configure the following tasks:

Create a Microsoft Entra ID Application
Get the Application ID and Directory ID
Get the Authentication Key
Assign a Role to the Microsoft Entra ID Application
List AD Users
Assess Key Vault

Create an Microsoft Entra ID Application

To create a Microsoft Entra ID application, follow the steps below:

Log in to portal.azure.com.
Navigate to All services > Identity > Microsoft Entra ID.
Click App registrations.
Click + New registration and enter the following details:
1. Name: Enter the name of the application.
2. Supported account types: Keep the default selection to Accounts in this organizational directory only.
3. Redirect URL (optional): Leave this blank.
Click Register.

For additional information, refer to the Microsoft Azure documentation located here.

Get the Application ID and Directory ID

After registering the Microsoft Entra ID application, the page redirects you to the Microsoft Entra ID application Overview page. Note down the Application (client) ID and Directory (tenant) ID.

Note

These values will be required when you set up the Azure application instance in the Netskope UI.

Get the Authentication Key

To get the authentication key, follow the steps below:

On the left navigation bar of the Microsoft Entra ID application page, click Certificates & secrets.
Under Client secrets, click + New client secret and enter the following details:
1. Description: Provide a description of the key.
2. Expires: Set a duration for the key.
Click Add.
After you save the configuration changes, under Client secrets, the Value column contains the authentication key. Copy it.
Important
Ensure that you authentication key under the Value column as it is not accessible once you leave this page. The authentication key will be required when you set up the Azure application instance in the Netskope UI.

For additional information, refer to the Microsoft Azure documentation located here.

Assign a Role to the Microsoft Entra ID Application

To assign a role, follow the steps below:

Log in to portal.azure.com.
Navigate to All services > General > Subscriptions.
On the Subscriptions page, click the appropriate subscription from the list.
If you want to set up multiple subscriptions, group them under a Management Group and assign a role at the Management Group. When you add a new subscription to the management group, Netskope will automatically detect the subscription and perform scans as per your configuration.
Click Access control (IAM).
Click + Add > Add role assignment.
Assign the roles and permissions specified in Step 2/3: Assign custom role permissions for Azure CSA.

For additional information, refer to the Microsoft Azure documentation located here.

List AD Users

Note

This procedure applies to continuous security assessment only.

For Netskope to list the AD users, you should grant the Directory.Read.All permission. To do so, follow the instructions below:

Navigate to All services > Identity > Microsoft Entra ID.
Click App registrations.
Locate the Microsoft Entra ID application you created earlier and click it.
On the left navigation bar of the Microsoft Entra ID application page, click API permissions.
Under API permissions, click + Add a permission.
Under Request API permissions, keep the Microsoft APIs tab selected. Select Microsoft Graph.
Under Microsoft Graph, select Application permissions and under Directory, select Directory.Read.All permission. Click Add permissions.
On the API permissions page, click Grant admin consent for <directory-name> and then click Yes.

Assess Key Vault

Note

This procedure applies to continuous security assessment only.

As part of continuous security assessment, if you need Netskope to assess Key Vault, follow the instructions below:

Configure an Access Policy on Key Vault

Navigate to All services > Security > Key vaults.
For each key vault, do the following:
1. Click on a key vault, navigate to Access policies, and click + Add new.
  Under Add access policy, enter the following:
  1. Select principal: Select the Microsoft Entra ID application you created earlier.Key permissions: Select Key Management Operations > List.Secret permissions: Select Secret Management Operations > List.Certificate permissions: Select Certificate Management Permissions > List.Click OK.
  On the Access policies page, click Save.