Azure FAQ and Troubleshooting
This article contains:
- A list of frequently asked questions related to connecting Azure to Tenable One AI Exposure.
- Subscription Status and Troubleshooting information.
Azure Subscription and Organization FAQs
This section contains a list of frequently asked questions related to connecting Azure subscriptions/organizations.
Pair Organization with Microsoft Entra ID
When I connect my organization to Tenable, should I pair it with Microsoft Entra ID?
Tenable recommends pairing your Microsoft Entra ID tenant with your organization. Doing so:
- Enables identity-related visibility, including users, permissions, and least-privilege analysis, providing a more complete risk assessment across your Microsoft cloud environment.
- Allows visibility into identities, permissions, and access relationships, enhancing security posture management beyond just resource visibility.
- Ensures comprehensive visibility across both cloud resources and identities, including all current and future subscriptions
Exclude a Folder or Subscription from Organization
How can I exclude a specific folder or subscription from an organization that I have already connected?
- In the Console, navigate to Settings > Integrations.
- Click on the three dots menu next to the organization, and click Edit.
- Click Next to navigate to the last step in the wizard (Scopes).
- Select Exclude specific folders and subscriptions and then select the relevant folder or subscription.
- Click Finish. It will be removed from the Console the next time Tenable syncs data in your environment.
Minimum Permissions for Microsoft Entra ID User
What are the minimum roles/permissions that my Microsoft Entra ID user needs to authorize the AI Exposure app in Azure, when I add a Microsoft Entra ID tenant in Tenable?
Granting admin consent requires you to sign in to Azure as a user that is authorized to consent on behalf of the organization. For more information about the specific roles needed to do this, refer to Microsoft documentation.
Key Vault Reader Role Assignment
Why does Tenable need to be granted the Key Vault Reader role assignment? Does this role grant Tenable access to key material?
The Key Vault Reader role only allows read access to metadata of key vaults and its certificates, keys, and secrets. It doesn’t grant access to read sensitive values such as secret contents or key material. For more information, refer to the relevant Microsoft documentation.
Update the Integration Name for the Organization
You can modify the name of your Azure organization integration/s, reflecting how the integration is displayed in AI Exposure. This can be useful for better identification, especially if you have multiple organizations.
To update the name:
- In the AI Exposure Console, navigate to Settings > Integrations.
- Click the three dots menu next to the relevant integration, and then click Edit.
- Navigate to step 2 in the wizard and update the Organization Name field.
- Click Next to navigate to the last step in the wizard and then click Update.
Microsoft Entra ID FAQs
This section contains a list of frequently asked questions related to connecting Microsoft Entra ID.
Handling Unused PII
How does AI Exposure handle PII that isn't directly used for product functionality? Is it stored in logs or databases?
AI Exposure only synchronizes the minimum set of user attributes necessary for product functionality from Microsoft Entra ID (and other identity providers).
Attributes not synchronized, such as birthday for Microsoft Entra ID, are never received or stored in any AI Exposure databases or logs. Therefore, no unused PII is retained.
For a detailed list of attributes synchronized by default from Microsoft Entra ID, refer to the official Microsoft Entra ID documentation. This information is subject to change based on updates from Microsoft.
Required User Permissions for Authorizing App
What minimum roles/permissions are required for my Microsoft Entra ID user to authorize the AI Exposure app during integration?
To grant admin consent for the AI Exposure app in Azure, your user must be authorized to consent on behalf of the organization. For more information about the specific roles needed to do this, refer to Microsoft documentation.
Connecting Public vs. China Microsoft Entra ID Tenants
Are there different connection procedures for public Microsoft Entra ID tenants versus China tenants?
Yes. Refer to the following instructions.
Just-in-Time (JIT) Access Support
Does the Microsoft Entra ID integration support Just-in-Time (JIT) Access
Yes. See Onboard Microsoft Entra ID for JIT.
Subscription Status and Troubleshooting
AI Exposure displays a Status for each subscription, indicating, for example, whether Tenable can connect to the subscription, and helping you troubleshoot potential connection issues.
| Status | Description |
|---|---|
| Microsoft Entra ID is not connected | The Microsoft Entra ID tenant is not connected. See Connect a Microsoft Entra ID Tenant for more information. |
| Connected | AI Exposure successfully connected to the subscription, and the subscription is up and running. |
| Deleting... this may take up to an hour | You deleted the subscription in AI Exposure, and the process hasn't completed yet. |
| Failed to connect |
AI Exposure failed to connect to the subscription. This might happen for one of the following reasons:
|
| Missing permissions | One or more of the listed roles are missing, and need to be added to the subscription. See Azure Required Permissions for more information. |
| Subscription is not enabled | The subscription is Expired, Past Due, or Warned, in Azure. Refer to the relevant Azure documentation for more information about subscription states. |
| Subscription is pending deletion | The subscription is Deleted or Disabled in Azure. Refer to the relevant Azure documentation for more information about subscription states. |