AuditBadger's Azure integration automatically collects compliance evidence from your Microsoft Azure infrastructure and Microsoft Entra (formerly Azure AD) directory. Once connected, it checks your tenant and subscriptions on a monthly schedule and gathers evidence that satisfies controls for SOC 2 and ISO 27001 frameworks. ### **Key benefits** * Automated evidence collection — no more manual screenshots or exports * Read-only access — AuditBadger never makes write API calls * Multi-subscription support — one service principal can grant access to many subscriptions in the same Entra tenant; rotate the secret in one place to update all of them * Auto-verification — every collected source is automatically checked against your compliance rules ### **Security model** * Read-only RBAC roles only (Reader, Key Vault Reader) * Microsoft Graph application permissions are admin-consented and read-only * Client secret is encrypted at rest using Rails Active Record Encryption * Tokens are never logged; only short-lived OAuth2 access tokens are minted on demand --- ## **Evidence sources** The Azure integration collects thirteen evidence types. Every source runs monthly by default and is auto-verified. Identity (Microsoft Entra): * **Entra MFA Status** — verifies MFA enrollment coverage across the tenant, MFA-enforcing conditional access policies, and admin MFA registration. Maps to SOC 2 CC6.1, CC6.6 and ISO 27001 A.5.15, A.5.17. * **Entra Conditional Access Policies** — inventories conditional access policies, their grant controls, and which apps and users they target. Maps to SOC 2 CC6.1, CC6.6 and ISO 27001 A.5.15, A.5.17. * **Entra Privileged Role Assignments** — inventories active assignments of Global Administrator and other directory roles. Maps to SOC 2 CC6.1 and ISO 27001 A.5.15. Logging and monitoring: * **Activity Log Configuration** — verifies subscription-level diagnostic settings export the Activity Log to Log Analytics, Storage, or Event Hub with the required retention and event categories. Maps to SOC 2 CC7.2, CC7.3 and ISO 27001 A.8.15, A.8.16. * **Defender for Cloud Secure Score** — collects the Defender for Cloud secure score and unresolved high-severity recommendations. Maps to SOC 2 CC7.1, CC7.2 and ISO 27001 A.8.16. * **Monitor Alert Rules** — inventories Azure Monitor metric alerts and activity-log alerts. Maps to SOC 2 CC7.1, CC7.2 and ISO 27001 A.8.16. Storage and encryption: * **Storage Account Encryption** — verifies encryption-at-rest, HTTPS-only enforcement, and minimum TLS on every Storage account. Maps to SOC 2 CC6.1, CC6.6, CC6.7 and ISO 27001 A.8.24. * **Storage Account Public Access** — audits public-blob and network-rule settings on every Storage account. Maps to SOC 2 CC6.1, CC6.6. * **Managed Disk Encryption** — verifies encryption-at-rest on every managed disk and reports the key source. Maps to SOC 2 CC6.1, CC6.7 and ISO 27001 A.8.24. * **SQL Database Encryption (TDE)** — verifies Transparent Data Encryption on every Azure SQL Database. Maps to SOC 2 CC6.1, CC6.7 and ISO 27001 A.8.24. * **Key Vault Key Rotation** — verifies key rotation policies and expiry on every key in every Key Vault. Maps to SOC 2 CC6.1, CC6.7 and ISO 27001 A.8.24. Network: * **SQL Server Firewall Rules** — audits SQL server firewall rules for 0.0.0.0/0 ingress and over-permissive ranges. Maps to SOC 2 CC6.1, CC6.6 and ISO 27001 A.8.20. * **Network Security Groups** — audits NSG rules for 0.0.0.0/0 ingress on RDP, SSH, and database ports and over-permissive outbound rules. Maps to SOC 2 CC6.6, CC6.7 and ISO 27001 A.8.20. Not collected yet: Backup jobs, and Privileged Identity Management eligible assignments (only active role assignments are read). --- ## **Setup** ### **1. Register a service principal** In the Azure Portal: * Open **Microsoft Entra ID → App registrations → New registration**. Name it **AuditBadger Compliance**. * Open **Certificates & secrets → New client secret**. Copy the **Value** immediately — you'll only see it once. You can also use the bundled `az` CLI script (Setup → Show script) or the Bicep / ARM JSON templates for IaC-first teams. ### **2. Assign subscription RBAC roles** On each subscription you want AuditBadger to monitor, grant the service principal these roles: * Reader * Key Vault Reader You can do this in **Subscription → Access control (IAM) → Add role assignment**, or with the provided Bicep/ARM templates. ### **3. Grant Microsoft Graph permissions** In **App registrations → Your app → API permissions**, add these Microsoft Graph **application** permissions and click **Grant admin consent**: * `Directory.Read.All` * `Policy.Read.All` * `UserAuthenticationMethod.Read.All` * `AuditLog.Read.All` If your security team won't approve `Directory.Read.All`, you can disable Entra signal collection per integration in AuditBadger settings; you'll lose the three Entra sources (MFA Status, Conditional Access Policies, Privileged Role Assignments); subscription-level sources keep collecting. ### **4. Connect the subscription in AuditBadger** Go to **Settings → Integrations → Microsoft Azure → Connect Azure subscription**. * If this is your first Azure integration, register the service principal first (Tenant ID, Application (client) ID, Client secret, optional display name). * Pick a subscription from the dropdown (AuditBadger auto-discovers subscriptions visible to the SP) or paste the Subscription ID directly. * Optionally set a label. AuditBadger validates the connection in the background and starts collecting evidence on the configured schedule (monthly by default). --- ## **Multi-subscription customers** If you have multiple subscriptions in the same Entra tenant, you can connect them all under a single service principal: * Register the SP once. * In **Connect Azure subscription**, choose **Use existing service principal** and pick a different subscription. When you rotate the SP secret in Azure, paste the new secret on the SP detail page in AuditBadger. Every connected subscription will be re-validated automatically. --- ## **Rotating credentials** Azure client secrets have a maximum lifetime of 24 months; many security teams rotate every 3–6 months. * Open the service principal in **Settings → Integrations → Microsoft Azure → Service principals → [your SP]**. * Generate a new secret in Azure (Certificates & secrets → New client secret). * Paste the new secret value in the **Rotate client secret** form and click **Rotate**. * AuditBadger invalidates cached tokens, re-validates every linked subscription in parallel, and shows live status for each. --- ## **Disconnecting** * Disconnect a subscription: removes the Integration::AzurePayload row. Evidence sources tied to that subscription stop collecting. Other subscriptions under the same SP are unaffected. * Delete a service principal: blocked while subscriptions reference it. Disconnect all subscriptions first. --- ## **Troubleshooting** * **"Invalid client secret or tenant configuration"** — check the Tenant ID and re-paste the secret. Secrets can also expire; verify it's still valid in Entra. * **"Service principal lacks Reader on subscription X"** — assign the **Reader** role on the subscription. Use the in-app Bicep/ARM template for one-shot fixes. * **"Microsoft Graph permission 'UserAuthenticationMethod.Read.All' is missing"** — open the app registration in Entra → API permissions → click **Grant admin consent**. The same message names whichever Graph permission is missing. * **"Subscription not found in tenant"** — the Subscription ID doesn't exist under the Entra tenant the SP belongs to. Re-pick from the dropdown. * Health check showing some services as degraded is normal if you haven't enabled Defender for Cloud or have no Key Vaults. The unhealthy services are skipped; the rest still collect evidence.