Add an Azure Adapter

Connect an Azure subscription to AttackLens for automatic resource discovery. This guide walks through creating an App Registration in Microsoft Entra ID, assigning the required permissions, and configuring the adapter in AttackLens.

INFO

Requires Admin role or higher.

Prerequisites

Before you begin, ensure you have:

• Azure portal access with permissions to create App Registrations and assign roles.
• The Subscription ID of the Azure subscription you want to discover.
• Access to AttackLens with an Admin account.

Step 1: Create an App Registration in Azure

AttackLens authenticates to Azure using a service principal (App Registration). You need four values: Tenant ID, Client ID, Client Secret, and Subscription ID.

1. Sign in to the Azure Portal.
2. Navigate to Microsoft Entra ID > App registrations.
3. Click New registration.
4. Enter a name (e.g., AttackLens Discovery).
5. Under Supported account types, select Accounts in this organizational directory only.
6. Leave the Redirect URI blank.
7. Click Register.

After creation, note down:

• Application (client) ID: displayed on the Overview page.
• Directory (tenant) ID: displayed on the Overview page.

Create a Client Secret

1. In the App Registration, go to Certificates & secrets.
2. Click New client secret.
3. Enter a description (e.g., AttackLens) and select an expiry period.
4. Click Add.
5. Copy the secret value immediately: it will not be shown again.

WARNING

Store the client secret securely. If you lose it, you will need to create a new one and update the adapter in AttackLens.

Step 2: Assign Permissions

AttackLens requires read-only access to discover resources. Assign the following roles at the subscription level.

Required Azure RBAC Role

Role	Scope	Purpose
Reader	Subscription	Read access to all Azure resources and their configurations

To assign the role:

1. Navigate to the target Subscription in the Azure Portal.
2. Go to Access control (IAM) > Role assignments.
3. Click Add > Add role assignment.
4. Search for Reader and select it.
5. On the Members tab, select User, group, or service principal.
6. Search for the App Registration name you created (e.g., AttackLens Discovery).
7. Click Review + assign.

Required Microsoft Graph Permissions

To discover Entra ID resources (users, groups, service principals, role assignments), the App Registration needs Microsoft Graph API permissions:

Permission	Type	Purpose
Directory.Read.All	Application	Read directory data (users, groups, service principals)
RoleManagement.Read.Directory	Application	Read role definitions and assignments

To assign Graph permissions:

1. In the App Registration, go to API permissions.
2. Click Add a permission > Microsoft Graph > Application permissions.
3. Search for and add Directory.Read.All and RoleManagement.Read.Directory.
4. Click Grant admin consent for [your tenant].

TIP

If you do not grant Graph permissions, AttackLens will still discover Azure infrastructure resources (VMs, networks, storage, etc.) but will not be able to discover Entra ID objects like users, groups, and role assignments.

Optional: Sensor Deployment Capability

If you want AttackLens to deploy sensors to Azure VMs via Run Commands, add:

Role	Scope	Purpose
Virtual Machine Contributor	Subscription	Execute Run Commands on VMs for sensor deployment

This is optional. If not granted, the adapter will still discover resources but will not be able to deploy sensors remotely.

Step 3: Configure the Adapter in AttackLens

1. In AttackLens, navigate to Discovery > Adapters.
2. Click Add Adapter.

3. Select Azure as the provider.

4. Enter a descriptive Name (e.g., Production Azure Subscription).
5. Fill in the Azure credentials:

Field	Value	Example
Tenant ID	Your Entra ID tenant ID	a1b2c3d4-e5f6-7890-abcd-ef1234567890
Client ID	The App Registration client ID	f1e2d3c4-b5a6-7890-abcd-ef1234567890
Client Secret	The secret you created	abC~dEfGhIjKlMnOpQrStUvWxYz012345
Subscription ID	The Azure subscription ID	12345678-abcd-ef12-3456-7890abcdef12

6. Optionally set the Scope to narrow discovery to a specific resource group (e.g., /subscriptions/{id}/resourceGroups/{name}). Leave blank to discover the entire subscription.

7. Optionally select specific Regions to limit discovery. Leave empty to discover resources across all regions.

Step 4: Test the Connection

1. Click Test Connection.
2. AttackLens will attempt to authenticate with the provided credentials and verify read access.
3. The test result shows:
   • Whether the connection is valid.
   • Which permissions were detected (e.g., Reader role, Graph permissions).
   • Whether sensor deployment capability is available.

WARNING

If the test fails, verify that:

• The Tenant ID, Client ID, and Client Secret are correct.
• The client secret has not expired.
• The Reader role is assigned at the subscription level (not a resource group).
• Admin consent was granted for Graph permissions.

Step 5: Save and Run Discovery

1. Click Save to create the adapter.
2. The first discovery run begins automatically after the adapter is saved.
3. You will be redirected to the adapter detail page where you can monitor the sync progress.

Discovery typically takes 2-5 minutes depending on the number of resources in the subscription.

Discovered Azure Resource Types

AttackLens discovers 80+ Azure resource types across 13 service categories:

Category	Examples
Compute	Virtual Machines, VM Scale Sets, Batch Accounts, Disks, Desktop Virtualization
Containers	AKS Clusters, Container Registries, Container Instances
Network	Virtual Networks, Subnets, NSGs, Firewalls, Load Balancers, Application Gateways, VPN Gateways, DNS Zones, Public IPs, Route Tables, Bastion Hosts
Storage	Storage Accounts, Blob Containers, File Shares
Data	SQL Databases, PostgreSQL, MySQL, Cosmos DB, Redis Cache, Data Factory, Data Lake
Security & Identity	Key Vaults, Entra ID Users, Groups, Service Principals, Role Assignments, Role Definitions, Conditional Access Policies
Monitoring	Log Analytics Workspaces, Alerts, Automation Accounts, Policy Assignments
Messaging	Service Bus, Event Hubs, Event Grid, Notification Hubs
Serverless	Functions, Logic Apps, IoT Hubs
AI/ML	Cognitive Services, Bot Services, Machine Learning Workspaces
Delivery	CDN Profiles, Static Sites
Backup	Backup Vaults

Next Steps

• View discovery snapshots to inspect the discovered resources.
• Manage adapters to edit, deactivate, or delete the adapter.
• Trigger a manual discovery if you make infrastructure changes.