Configure RBAC roles in Microsoft Azure

For Alert Logic to protect assets in Microsoft Azure, you must create a user account with specific permissions. Role-Based Access Control (RBAC) enables fine-grained access management for Azure accounts. Assignment of a RBAC role to the user account you create grants only the amount of access required to allow Alert Logic to monitor your environments.

This procedure requires administrative permissions in Azure, and the installation of one of the following command line interfaces:

• Azure Command Line Interface (CLI) 2.0

• Azure PowerShell

To configure your RBAC role in Azure:

1. Create a user account in Azure
2. Create a custom RBAC role
3. Assign the role to the user account

Create a user account in Azure

1. Log in to the Azure portal.
2. On the left menu, click Azure Active Directory.

3. In the Azure Resource Menu, click Domain names, and then make note of the primary Active Directory domain name.

4. In the Azure Resource Menu, click Overview.
5. In the Azure Active Directory blade, under Quick tasks, click Add a user.
6. Enter a Name (for example, AL Cloud Defender).
7. Enter a User name. The user name should be in the form of an email address based on the Active Directory (for example, ALCloudDefender@alazurealertlogic.onmicrosoft.com).

8. Select the Show Password check box and make note of the password.
9. Click Create. Profile and Properties can be set if needed.
10. Back on the Azure Active Directory blade, click Users and groups.
11. Click All users, and ensure the new user name appears in alphabetical order in the list.
12. Open a new browser window.
13. Log in to the Azure portal as the new user.
14. At the prompt, change the password for the user.

Create a custom RBAC role

RBAC roles enable fine-grained access management for Azure. After you create a user account, you must assign an RBAC role to the user. The Alert Logic RBAC role grants only the amount of access required to monitor your environments.

 

To create a custom RBAC role:

• Create a role document.
• Create a custom role in Azure.

To create a role document:

1. Create a new text file and copy the Alert Logic RBAC role into it.

2. Make the following changes to the file:
   1. In the Name field, change the entry to the user name for the user account you just created.
   2. In the AssignableScopes field, change the <subscription ID> value to the Subscription ID value found on your Azure portal Subscriptions blade.
3. Save the text file as a .JSON file.

To create a custom role in Azure:

1. Open either Azure CLI or Azure PowerShell and log in to your Azure account and specify the default subscription.

2. Create your custom role in Azure.

3. In the Azure portal, verify that the new role appears in the Roles tab in Subscriptions > Access Control (IAM).

Assign the role to the user account

Once the RBAC role is created, it must be assigned to the user account. In Azure, roles are assigned in the Access Control portion of the Subscriptions blade.

1. In the Azure Navigation Menu, click Subscriptions.
2. In the Subscriptions blade, select the subscription you want Alert Logic to protect and then click Access Control (IAM).

3. Above the list of users, click +Add.
4. In the Add access blade, select the created RBAC role from those listed.
5. In the Add users blade, enter the user account name in the search field and select the user account name from the list.
6. Click Select.
7. Click OK.