Overview

Microsoft Azure is a cloud hosting platform that offers cloud computing and infrastructure services.

Secureframe scans various Azure resources and configurations to ensure compliance and automatically gather evidence.

Connecting the Integration

To integrate Azure with Secureframe, navigate to Integrations and search for “Azure” on the “Available Integrations” page. Click “Connect” and follow the steps in the connection form.

Secureframe now integrates with both Organization & Subscription. To connect a Subscription, an Organization must also be connected.

Connecting at different levels of the hierarchy (Organization & Account)

Azure allows users to manage connections at various levels in the hierarchy e.g. Management groups and subscriptions. Secureframe allows you to integrate with the Organization level as well as the subscription (child) connection in order to:

• Make it easier to pull in and set up multiple account connections under an organization at once, allowing you to save time
• Provide a cleaner experience in organizing and managing the different levels of the hierarchy enabled in your Azure account
• Make it easier to identify accounts by automatically discovering accounts associated to your organization
• Make it easier to exclude the accounts that you do not want to sync with Secureframe

Manage connections/sync

You can now easily manage your subscription (child) connections directly from the Integrations page.

• To sync all accounts under a connection click the sync button
• In order to sync or manage only specific accounts under a connection, click the # of connections
  • You can now view and manage the settings, rename the connection, reconnect and archive a subscription(child) account directly from this screen

Migrating existing connections in Secureframe to Parent/Child connections

If you already have multiple Azure accounts set up as separate connections in Secureframe and you want to take advantage of managing your connections through the parent/child connection. Follow these steps.

1. 1. Archive any individual existing subscription connections you have that you are expecting to be pulled in by the organization connection. Note: if you have any subscription connections that you’re not expecting to be brought in by the organization connection, you do not need to archive those subscription accounts in Secureframe.
      1. 1. Click the kebab menu on individual subscription accounts
         2. Click archive

            

            

   2. Once your connections have been archived, click on available connections, search for “Azure” and click “add connection” or “connect” under Azure.

      

   3. Follow the steps outlined in the connection form under “Azure Management Group”.

      

   4. Click “retrieve subscriptions” (step 9) in the connection form to retrieve the list of all subscription accounts, where you will be able to select from the list of subscription accounts any that you do not want to integrate with Secureframe.

      

   5. Click start connection. When completed you will now be able to see the number of  child connections under an organization account (and their details) directly in the main integrations page.

      

   6. When you click on the number of child (subscription) connections, you will be able to see details of the subscription connections and be able to:
      1. Filter through child connections
      2. Sync individual child connections or sync all subscription accounts under the organization
      3. Rename the connection (organization or subscription connection)
      4. Exclude any individual subscription connections you don’t want integrated with Secureframe

Azure test permissions error

What is this error?
There are some permissions that the Azure integration purposefully does not initially ask for, for a variety of reasons. This includes the permissions necessary for certain tests related to KeyVault keys and secrets.

How can I resolve this error?
You will need to provide us with an additional role called Key Vault Reader.
You can read more about the specific permissions in Key Vault Reader here.
Please note that according to the Azure documentation, this role "cannot read sensitive values such as secret contents or key material. Only works for key vaults that use the 'Azure role-based access control' permission model."

How to provide Key Vault Reader permissions:
Click "Access Control (IAM)"
Click "Add".
Click "Add role assignment".
Search for Key Vault Reader.
Click "view" on the "Key Vault Reader" row.
Click "Select Role".
Click "Next".
Click "Select members".
Select Secureframe.
Click "Select".
Click "Next".
Click "Review + assign".
Alternatively you may create a custom role with the following permissions and assign it to the Secureframe member:
- actions: "Microsoft.KeyVault/vaults/*/read"
- dataActions: "Microsoft.KeyVault/vaults/*/read",
"Microsoft.KeyVault/vaults/secrets/readMetadata/action"

How safe is it to grant these permissions?
Support cannot say what is right for your environment and your level of risk tolerance. Please review the required permissions along with the benefits of these tests and have a conversation with your security staff.

SOC 2 controls covered by connecting Azure

The following SOC 2 controls are automatically covered by connecting your Azure account:

• The company maintains a list of system components, owners, and their business function
• The company uses logging and monitoring software to collect data from servers and endpoints, detect potential security threats and unusual system activity, and monitor system performance
• The company uses alerting software to notify impacted teams of potential security and availability events
• Production infrastructure is restricted to users with a unique account, SSH key or access key
• Administrative access to production servers, databases, and internal administrative tools is restricted based on the principle of least privilege. Internal user access to systems and applications with customer data requires two-factor authentication in the form of user ID/password, and one-time passcode
• Passwords are required to be a minimum length
• Users are assigned unique IDs to access sensitive information
• Service data is encrypted at rest and in transit
• Encryption is used to protect the transmission of data over the internet
• System tools monitor company load balancers and notify the appropriate personnel of any events or outages based on predetermined criteria. Any issues are tracked through resolution in accordance with the Incident Response Plan
• The system is configured to operate across availability zones to support continuous availability
• Physical security controls are inherited via Azure
• Full backups are performed daily and retained in accordance with the Backup Policy
• Management has implemented intrusion prevention and detection tools to monitor network traffic to the production environment
• Firewall configurations and security groups ensure available networking ports and protocols are restricted according to the approved business rules

Available Azure Tests

Below is the list of all available tests for Azure: