AuditBadger Help Center

Azure Integration User Guide

Open in
View as Markdown Open in ChatGPT Open in Claude
M

Maciej Litwiniuk

Last updated on Sep 14, 2026

AuditBadger's Azure integration automatically collects compliance evidence from your Microsoft Azure infrastructure and Microsoft Entra (formerly Azure AD) directory. Once connected, it checks your tenant and subscriptions on a monthly schedule and gathers evidence that satisfies controls for SOC 2 and ISO 27001 frameworks.

Key benefits

  • Automated evidence collection — no more manual screenshots or exports

  • Read-only access — AuditBadger never makes write API calls

  • Multi-subscription support — one service principal can grant access to many subscriptions in the same Entra tenant; rotate the secret in one place to update all of them

  • Auto-verification — every collected source is automatically checked against your compliance rules

Security model

  • Read-only RBAC roles only (Reader, Key Vault Reader)

  • Microsoft Graph application permissions are admin-consented and read-only

  • Client secret is encrypted at rest using Rails Active Record Encryption

  • Tokens are never logged; only short-lived OAuth2 access tokens are minted on demand

Evidence sources

The Azure integration collects thirteen evidence types. Every source runs monthly by default and is auto-verified.

Identity (Microsoft Entra):

  • Entra MFA Status — verifies MFA enrollment coverage across the tenant, MFA-enforcing conditional access policies, and admin MFA registration. Maps to SOC 2 CC6.1, CC6.6 and ISO 27001 A.5.15, A.5.17.

  • Entra Conditional Access Policies — inventories conditional access policies, their grant controls, and which apps and users they target. Maps to SOC 2 CC6.1, CC6.6 and ISO 27001 A.5.15, A.5.17.

  • Entra Privileged Role Assignments — inventories active assignments of Global Administrator and other directory roles. Maps to SOC 2 CC6.1 and ISO 27001 A.5.15.

Logging and monitoring:

  • Activity Log Configuration — verifies subscription-level diagnostic settings export the Activity Log to Log Analytics, Storage, or Event Hub with the required retention and event categories. Maps to SOC 2 CC7.2, CC7.3 and ISO 27001 A.8.15, A.8.16.

  • Defender for Cloud Secure Score — collects the Defender for Cloud secure score and unresolved high-severity recommendations. Maps to SOC 2 CC7.1, CC7.2 and ISO 27001 A.8.16.

  • Monitor Alert Rules — inventories Azure Monitor metric alerts and activity-log alerts. Maps to SOC 2 CC7.1, CC7.2 and ISO 27001 A.8.16.

Storage and encryption:

  • Storage Account Encryption — verifies encryption-at-rest, HTTPS-only enforcement, and minimum TLS on every Storage account. Maps to SOC 2 CC6.1, CC6.6, CC6.7 and ISO 27001 A.8.24.

  • Storage Account Public Access — audits public-blob and network-rule settings on every Storage account. Maps to SOC 2 CC6.1, CC6.6.

  • Managed Disk Encryption — verifies encryption-at-rest on every managed disk and reports the key source. Maps to SOC 2 CC6.1, CC6.7 and ISO 27001 A.8.24.

  • SQL Database Encryption (TDE) — verifies Transparent Data Encryption on every Azure SQL Database. Maps to SOC 2 CC6.1, CC6.7 and ISO 27001 A.8.24.

  • Key Vault Key Rotation — verifies key rotation policies and expiry on every key in every Key Vault. Maps to SOC 2 CC6.1, CC6.7 and ISO 27001 A.8.24.

Network:

  • SQL Server Firewall Rules — audits SQL server firewall rules for 0.0.0.0/0 ingress and over-permissive ranges. Maps to SOC 2 CC6.1, CC6.6 and ISO 27001 A.8.20.

  • Network Security Groups — audits NSG rules for 0.0.0.0/0 ingress on RDP, SSH, and database ports and over-permissive outbound rules. Maps to SOC 2 CC6.6, CC6.7 and ISO 27001 A.8.20.

Not collected yet: Backup jobs, and Privileged Identity Management eligible assignments (only active role assignments are read).

Setup

1. Register a service principal

In the Azure Portal:

  • Open Microsoft Entra ID → App registrations → New registration. Name it AuditBadger Compliance.

  • Open Certificates & secrets → New client secret. Copy the Value immediately — you'll only see it once.

You can also use the bundled az CLI script (Setup → Show script) or the Bicep / ARM JSON templates for IaC-first teams.

2. Assign subscription RBAC roles

On each subscription you want AuditBadger to monitor, grant the service principal these roles:

  • Reader

  • Key Vault Reader

You can do this in Subscription → Access control (IAM) → Add role assignment, or with the provided Bicep/ARM templates.

3. Grant Microsoft Graph permissions

In App registrations → Your app → API permissions, add these Microsoft Graph application permissions and click Grant admin consent:

  • Directory.Read.All

  • Policy.Read.All

  • UserAuthenticationMethod.Read.All

  • AuditLog.Read.All

If your security team won't approve Directory.Read.All, you can disable Entra signal collection per integration in AuditBadger settings; you'll lose the three Entra sources (MFA Status, Conditional Access Policies, Privileged Role Assignments); subscription-level sources keep collecting.

4. Connect the subscription in AuditBadger

Go to Settings → Integrations → Microsoft Azure → Connect Azure subscription.

  • If this is your first Azure integration, register the service principal first (Tenant ID, Application (client) ID, Client secret, optional display name).

  • Pick a subscription from the dropdown (AuditBadger auto-discovers subscriptions visible to the SP) or paste the Subscription ID directly.

  • Optionally set a label.

AuditBadger validates the connection in the background and starts collecting evidence on the configured schedule (monthly by default).

Multi-subscription customers

If you have multiple subscriptions in the same Entra tenant, you can connect them all under a single service principal:

  • Register the SP once.

  • In Connect Azure subscription, choose Use existing service principal and pick a different subscription.

When you rotate the SP secret in Azure, paste the new secret on the SP detail page in AuditBadger. Every connected subscription will be re-validated automatically.

Rotating credentials

Azure client secrets have a maximum lifetime of 24 months; many security teams rotate every 3–6 months.

  • Open the service principal in Settings → Integrations → Microsoft Azure → Service principals → [your SP].

  • Generate a new secret in Azure (Certificates & secrets → New client secret).

  • Paste the new secret value in the Rotate client secret form and click Rotate.

  • AuditBadger invalidates cached tokens, re-validates every linked subscription in parallel, and shows live status for each.

Disconnecting

  • Disconnect a subscription: removes the Integration::AzurePayload row. Evidence sources tied to that subscription stop collecting. Other subscriptions under the same SP are unaffected.

  • Delete a service principal: blocked while subscriptions reference it. Disconnect all subscriptions first.

Troubleshooting

  • "Invalid client secret or tenant configuration" — check the Tenant ID and re-paste the secret. Secrets can also expire; verify it's still valid in Entra.

  • "Service principal lacks Reader on subscription X" — assign the Reader role on the subscription. Use the in-app Bicep/ARM template for one-shot fixes.

  • "Microsoft Graph permission 'UserAuthenticationMethod.Read.All' is missing" — open the app registration in Entra → API permissions → click Grant admin consent. The same message names whichever Graph permission is missing.

  • "Subscription not found in tenant" — the Subscription ID doesn't exist under the Entra tenant the SP belongs to. Re-pick from the dropdown.

  • Health check showing some services as degraded is normal if you haven't enabled Defender for Cloud or have no Key Vaults. The unhealthy services are skipped; the rest still collect evidence.