Setting up Azure Arc data collection

In this article, we describe the steps that will allow the OC Collector application to access an Azure tenant and collect the Azure Arc data.

Step 1: Create an enterprise application in Microsoft Entra ID

This step should be performed by someone with at least the Microsoft Entra ID built-in role: 
Cloud Application Administrator

Open the Microsoft Entra Admin Center ( https://entra.microsoft.com )

Next, click on the Enterprise apps menu item and on the all applications page under the manage section, select new application:

Next, click on Create your own application:

In the Create your own application menu, which opens on the right side of the screen, select the Register an application to integrate with Microsoft Entra ID (App you're developing) option and click Create. (Don't put a name in just yet. We will do this in the next step):

Now, enter a Name for your application. We suggest giving it a name like OC3-AzureArc-Module for easy identification.

Next, select who can use this application or access this API in accordance with your company standards. We suggest selecting the default: Single tenant only - %your company tenant name%

Leave all other settings as is and click Register.

Again, click on the Enterprise apps menu item. If all went well with the application registration, you will now see an entry for the new application. To continue, click on the application name:

Next, click on the properties menu item under the manage section on the left side of the page

We advise adding a note describing what the application is being used for, like:

This application is used by the OC3 AzureArc Module to collect AzureArc data  

Configure assignment and visibility settings as per company policy, please remember to click Save afterward.

Next, click on application registration on the same page to continue configuration:

Step 2: Create an application secret

Click on the Certificates & Secrets menu item under the Manage section on the left.

Next, select either Certificates or Client Secrets (as per company policy)

In this example, we will create a Client Secret by clicking on New Client Secret:

The add a client secret menu opens on the right of the page. Please fill out a suitable client secret Description and select the appropriate expiration period (as per company policy), and then click Add:

Step 3: Grant API permissions

Now click on the API Permissions menu item under the Manage section on the left.

Next click on Add Permission:

On the request API Permissions menu on the right, click on the Microsoft Graph API tile:

Next, click on Delegated Permissions to continue:

Now type organization.read.all in the search bar

If it finds multiple entries, then just click on the dropdown button next to the word Organization and select the checkbox in front of the organization.read.all permission.

Next, click add permissions at the bottom of the page:

Step 4: Grant API permissions consent

This step can only be performed by someone with the Microsoft EntraID built-in role: Global Administrator

Admin consent must be granted to allow the application to access all API permissions. If you are a Global Administrator, you can do so yourself. Otherwise, you have to ask a Global Administrator to click on Grant admin consent for your organization:

Next, confirm the consent by clicking on yes:

You will notice that all API permissions now have the status Granted for your organization:

Step 5: Grant Azure RBAC permissions at the Management Group level

This step should be performed by someone with at least the Azure RBAC role Owner or User Access Administrator at the Tenant Root Group Management Group

Open the Microsoft Azure Portal ( https://portal.azure.com )

Open the Management Groups configuration menu by typing Management Groups in the search bar and clicking on Management Groups:

Click on Tenant Root Group

Now select the Access Control (IAM) menu item on the left side of the page, click the dropdown button next to Add, and click on Add role assignment:

Type Management Group Reader in the search bar of the Role TAB of the Add Role Assignment menu, click on Management Group Reader in the list of role names, and click on Next at the bottom of the page.

On the Members TAB of the Add Role Assignment menu, make sure that Assign Access to: User, group, or service principal is selected. Then, click on Select Members.

The select members menu will open on the right side of the page.

Now, type the name of the newly created Enterprise Application in the search bar, then click the application name that appears below the search bar so the name is added under selected members. Now click on Select.

Make sure the correct application name is selected for the role member, then click review + assign. If your company policy doesn't support permanent assignments, you can click on next to set a different assignment duration.  

Review your selection on the Review + assign TAB of the add role assignment menu, and click on Review + assign.

The service principal of the selected application should now be visible on the Roles TAB of the Access Control (IAM) menu with the Management Group Reader role:

Step 6: Grant Azure RBAC permissions at the subscription level

This step should be performed by someone with at least the Azure RBAC Owner or User Access Administrator role on all subscriptions that contain Azure Arc metadata objects whose data should be collected by the OC3 AzureArc Module.

Open the Microsoft Azure Portal ( https://portal.azure.com )

Open the Subscriptions configuration menu by typing Subscriptions in the search bar and clicking on Subscriptions:

Now, click on the subscription name for which you need to assign the access permissions.

Now select the Access Control (IAM) menu item on the left side of the page, click the dropdown button next to Add, and click on Add role assignment.

Type Reader in the search bar of the Role TAB of the Add Role Assignment menu, click on Reader in the list of role names, and click on Next at the bottom of the page.

On the Members TAB of the Add Role Assignment menu, make sure that Assign Access to: User, group, or service principal is selected. Then, click on Select Members.

The select members menu will open on the right side of the page.

Now, type the name of the newly created Enterprise Application in the search bar, then click the application name that appears below the search bar so the name is added under selected members. Now click on Select.

Make sure the right application name is selected as a role member, and click on review + assign. If your company policy doesn't support permanent assignments, you can click on next to set a different assignment duration. 

Review your selection on the Review + assign TAB of the add role assignment menu and click on Review + assign.

The service principal of the selected application should now be visible on the Roles TAB of the Access Control (IAM) menu with the Reader role.

Step 7: Collect the required values to configure the OC Collector data source

The Directory Tenant ID, Application ID, and the Application Secret value (which you wrote down in Step 2 of this document) should be gathered and shared with the Engineer responsible for configuring the OC3 Collector data source target, which should retrieve the AzureArc metadata from your Azure Tenant   

The Directory (Tenant) ID and Application (Client) ID can be found in the Microsoft Entra Admin Center, clicking on App Registrations in the left side menu and selecting your application from the list of registered applications on the All Applications tab:

If you select the overview page, you will be able to copy the values for Directory (Tenant) ID and Application (Client) ID:

Step 8: Prerequisites for the OC Collector to retrieve data from Azure Arc

The collector that is accessing the Azure tenant to retrieve the Azure Arc data, needs internet access and needs to be able to access the following URLs on TCP port 443:

• https://login.microsoftonline.com (for Azure access token)
• https://management.azure.com (for Azure data)
• https://graph.microsoft.com (for Azure AD)