# Azure VM Access Configuration

## Entra ID App Registration

Log into your [**Azure Portal**](https://portal.azure.com/) and navigate to the **Microsoft Entra ID service**.

Click on **Add** and select **App registration**

![Azure portal: Add new user, group, enterprise app, or app registration in Default Directory.](https://help.aikidogov.us/_assets/5656b732482f/ucarecdn-7272798b-6ece-4bc5-9e40-df364a5e7a1f.png)

Give the application a meaningful name, we need this name later.

Leave the **Supported account types** default: **Accounts in this organizational directory only**.

Click on **Register**.

![Azure portal screen for registering a new application named "AikidoSecurity" with account type selection.](https://help.aikidogov.us/_assets/fb6a60b3d246/ucarecdn-4690d5db-e42d-4d8d-93a0-b978333c1364.png)

You get redirected to the detail page of the newly created application. Here you can find and copy the **Application (client) ID** and the **Directory (tenant) ID**

![Azure portal showing AikidoSecurity application's client ID and essential overview details.](https://help.aikidogov.us/_assets/f12ac027946b/ucarecdn-4ce56e1e-0436-430e-8492-e4e85120a1d3.png)

At the client credentials field, click "Add a certificate or secret"

![Azure portal displaying AikidoSecurity app overview and client credential configuration options.](https://help.aikidogov.us/_assets/32881ca907b6/ucarecdn-5d15f5a3-597a-473f-87d0-733e9859afaa.png)

Click the "New client secret"-button, give a description for the secret and set the expiration date to 2 years (730 days / 24 months)

![Creating a new client secret for application authentication in Azure AD.](https://help.aikidogov.us/_assets/daeb8b0fe497/ucarecdn-121cb5f1-e88a-4223-b42d-a4c8333dc37c.png)

Copy the **Secret's Value**

![Azure portal client secret management screen showing secret description, expiry date, and copy option.](https://help.aikidogov.us/_assets/573f68cf5ced/ucarecdn-04e75758-4d58-4f1f-bacd-bac394368b76.png)

You now have all the required values to add the Azure Cloud via the Public API once the application setup is complete in Azure Portal.

## Azure RBAC Role Assignment

Go to the subscription detail page. Now we need to make sure we grant access to the roles we need.

Navigate to **Subscriptions**, find the relevant Subscription for your Virtual Machines

Click on **"Access Control (IAM)"**.

![Azure IAM access control panel for managing roles and permissions in a subscription.](https://help.aikidogov.us/_assets/5181f13233ba/ucarecdn-1c719e05-4e24-4386-b2dd-8f82e0bbf7a9.png)

Go to the Role assignments tab & Click on **"Add"**, then **"Add role assignment"**.

![Azure portal interface for adding role assignments and managing classic administrators.](https://help.aikidogov.us/_assets/b7a87ef0689c/ucarecdn-4feba3fe-538d-4b7e-b1f7-615bda664244.png)

In the **"Role"** tab, search and select **"VM Scanner Operator"** & Click **"Next"**.

![Assigning "VM Scanner Operator" role for disk snapshot security analysis in Azure.](https://help.aikidogov.us/_assets/958fed841a37/ucarecdn-891c0d87-d666-4c75-8199-ed8d65d7bbf2.png)

Leave the **"Assign access to**" default value.

Click on **"Select Members"**, search for the name of the app registration (e.g. "AikidoSecurity") you created and select it.

Click **"Select"**

Click **"Review + assign"** twice

![Assigning a role to a member in Azure subscription using Access Control (IAM) settings.](https://help.aikidogov.us/_assets/c9eb454227ac/ucarecdn-4ee31542-c6c9-40da-a557-b264660a458d.png)

Repeat the role assignment process for the role **"Disk Snapshot Contributor"**.

The App Registration now has the required roles to scan your virtual machines.