Onboard Azure Infrastructure via Terraform

Overview

This guide will help you onboard Azure Subscriptions or Tenants to Netskope DSPM (also known as Netskope One DSPM) using Terraform. This allows DSPM to discover, scan, and classify your data store activities.

Prerequisites

Before you begin, make sure these tools are installed, and you’re signed in:

• Terraform CLI
• Azure CLI

To ensure you’re using the latest versions of these tools, run the following commands in your terminal:

terraform -version  
az version

Instructions for Infrastructure Connection

This workflow starts in Netskope DSPM, continues with actions in the Terminal on your local machine, and ends back in DSPM to complete the setup.

• In the Netskope DSPM console:

  1. Go to Administration > Infrastructure Connections.

  2. Go to Azure tab > Click Add Infrastructure >

     • Select Add Subscription to onboard a single subscription.
     • Select Add Tenant to onboard an entire Azure Tenant (Root Management Group).

  3. Select Capabilities tab > Adjust the toggles based on your discovery and classification needs.

     The following table describes the available capabilities and the permissions they include:

     Toggle Description	Details
     Auto-Discover New Data Stores	Enables the auto-discovery of newly created data stores (e.g., SQL Servers, Storage Accounts) to ensure DSPM is always aware of your assets. Configures the Auto-Discovery Role.
     Authorize Data Store Snapshots Access	Enables snapshot-based scanning for data stores on disk volumes and the discovery of unmanaged data stores. Configures the Data Store Snapshot Role.
     Auto-Discover New Subscriptions	Enables the auto-discovery and onboarding of newly added subscriptions within the tenant, ensuring your account list remains accurate.

     (Azure Tenant Onboarding) Auto-Discover New Subscriptions: This capability enables auto-discovery for new subscriptions in the tenant. When enabled, Netskope One DSPM will automatically detect and onboard new subscriptions as they are added to the tenant.

  4. Click Next > Fill in the following values.

     • For Subscription: Enter the Subscription Name and ID.
     • For Tenant: Enter the Tenant Name and ID.

     Field	Value
     Tenant Name	Any value (this is used to identify your infrastructure connection within Netskope DSPM).
     Tenant ID	Obtain from your Azure console:
     Netskope DSPM Service Account Role	Will default to Netskope DSPM_Role. Note that this value needs to be unique to each onboarded Tenant

  5. Select Terraform > Click Download Template.

  6. Don’t close this window and leave it on the Add Infrastructure modal to return to it later.

• In the Terminal on your local machine:

  1. Go to the ZIP file path of the Terraform template (eg. cd C:\Users\User\Downloads)

  2. Run the unzip command (eg. unzip file_name.zip)

     • In the extracted org folder, you’ll find the necessary Terraform files.

  3. In the org folder, run terraform init to initialize.

     • You’ll see Initializing the backend, followed by a success message.

  4. Run terraform apply to start the script.

     • Terraform will show a warning if you’re not logged in or your Azure credentials aren’t set correctly.

  5. Type Yes when you see an output of resources created in your org folder, including the Application ID, Application Secret, and Tenant ID values.

     • After completion, you’ll see the Apply complete! Resources: XX added, 0 changed, 0 destroyed message.

  6. Don’t close this window and leave it on the output values to return to it later.

• In the Netskope Console:

  1. Return to the Add Infrastructure Modal > Copy and paste the output values into the Summary Info fields.

     Netskope DSPM Field	Corresponding Alphanumeric Value
     Application ID	application_id
     Application Secret	secret
     Tenant ID	tenant_id

     

  2. Click Save > Click I’ve already run the template.

Your Azure Subscription or Tenant is now connected, and Netskope DSPM can begin discovering data stores.

Reference: Azure Permissions & Roles

The Terraform template automatically configures the necessary roles based on the capabilities you selected in the UI.

All permission details documented here apply equally to:

• Manual configuration through the Azure portal
• Terraform deployments
• Troubleshooting and debugging any deployment method

{
    "properties": {
        "roleName": "Netskope One DSPM Core Role",
        "description": "",
        "assignableScopes": [
            "/subscriptions/<AZURE SUBSCRIPTION ID>"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Authorization/roleAssignments/read",
                    "Microsoft.Authorization/roleDefinitions/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

Grant Permissions for Role Validation

Netskope DSPM requires the Application.Read.All permission to validate the roles assigned to the App/Service Principal and to perform automatic misconfiguration analysis. Terraform creates the app, but you must manually grant this permission in the Azure portal.

1. Go to App registrations > Search for the Netskope DSPM app created by the Terraform script (use the Application ID from the terminal output to find it).
2. Go to API permissions > Select Microsoft Graph.
3. Go to Application (1) > Mark the Application.Read.All permission > Click Update permissions.
4. Select Grant admin consent for Default Directory to remove the warning.

Troubleshooting Permission Issues

If you encounter errors after deployment, verify that Terraform successfully assigned the roles corresponding to your selected capabilities.

• “Cannot discover and scan data store snapshots due to missing permissions.”
  • Fix: Rerun the onboarding and ensure Authorize Data Store Snapshots Access is enabled, or manually assign the Netskope One DSPM Data Store Snapshot Role.
• “Netskope encountered an error while scanning data warehouse ‘XYZ’: Missing required Azure permissions…”
  • Fix: Identify the missing permission in the error log and ensure your Terraform template is up to date.
• “Insufficient privileges to complete the operation…”
  • Fix: Ensure the Terraform script ran without errors regarding Azure AD Graph permissions (Application.Read.All).