Configuring TOS Permissions for an Azure Resource Group

Overview

To monitor an Azure Resource Group, TOS must have permission to access it. Grant the necessary permissions by creating a custom role for the Resource Group and configuring that role with your SecureTrack app registration.

You must perform this procedure for each Resource Group you want to add to SecureTrack.

Creating a Custom TOS Role in Azure

  1. Log in to your Azure Account through the Azure portal.

  2. Select the Resource Group you wish to be monitored by TOS.

  3. Go to the Access Control page, and click Add > Add Custom Role.

    The Custom Role Editor is displayed.

  4. In the Basics tab, fill out the following information:

    1. Custom role name and Description: Enter a name and description for the custom role.

    2. Baseline Permissions: Select Clone a role.
    3. Role to clone: Select Reader.

  5. Click Next to move to the Permissions tab.

  6. Click Add Permissions.

  7. Search for Microsoft Network.

  8. Click on the Microsoft Network tile, and select the following permissions:

    • Read: Get Express Route Service Provider

    • Write: Create or Update Route

    • Other: Gets virtualNetworkGateway advertised routes

    • Other: Gets virtualnetworkgateway learned routes

    TOS does not create or update routes in Azure. The Write permissions are required to use the Azure REST API, which uses the POST method to retrieve routing tables. This information is required by TOS for topology mapping and network troubleshooting.

  9. Click Add.

  10. Create the custom role by clicking Review+Create.

  11. In the Access Control page, click Add > Add Role Assignment.

    12. The Add Role Assignment pane is displayed.

  12. In the Role field, select the role you created.
  13. In the Select field, select the SecureTrack App registration.
  14. Click Save.
  15. Repeat for each Resource Group you would like TOS Aurora to monitor.