Connect an Azure Organization

Connect your entire Azure organization to expedite and automate the integration process in cloud environments with many accounts. Doing so allows you to:

• Automatically connect all current and future subscriptions under the Azure organization, eliminating the need to add subscriptions individually.
• Ensure consistent visibility and coverage across the Azure environment, preventing potential blind spots.

Prerequisites

Before you begin:

• Ensure you can access the Azure organization (root management group) you want to connect.
• Ensure you have permissions to create or use an application identity in Microsoft Entra ID for authentication to Azure APIs.
• (Public environments only) To verify tenant access, ensure you are either a member of the tenant organization or a guest user with the Global Administrator role. You can only be a guest user if you have integrated Microsoft Entra ID with the Tenable One AI Exposure Console.

Connect an Organization

To connect an Azure organization:

1. In the AI Exposure Console, navigate to Settings > Integrations and click + Add integration.
2. In the Integrations Library, click Azure Organization. The Azure Organization wizard opens.
3. In the Configuration step (step 1 of 2):
   1. Enter a name for the integration.
   2. Select the relevant Azure Cloud environment: Public or China.
      • Public — The deployment script creates a service principal in your tenant tied to Tenable's multi-tenant app, which is used to pull data via the Microsoft Graph API.
      • China — You will need to manually create a dedicated app registration in Microsoft Entra ID, as instructed in the Application section of the wizard. The deployment script creates a service principal tied to the app registration, which is used to pull data via the Microsoft Graph API.
   3. Under Microsoft Entra ID, select whether to use an existing Microsoft Entra ID integration. It is recommended to connect Microsoft Entra ID to enable full identity visibility.
      • If an integration does not exist, you can click + Add to add it now.
      • If selecting Do not use Microsoft Entra ID integration, enter the Tenant ID associated with the relevant Azure organization to allow Tenable to identify the correct organization.
   4. Under Access Verification, click Verify. You are redirected to sign in to your Microsoft Entra ID tenant. This step ensures that the user creating the integration is a member of a target tenant or a guest user with the Global Administrator role, and is only required for public environments.
   5. (Chinese environments only) Under Application, create a dedicated app registration in Microsoft Entra ID by following these instructions, making sure to copy and save the relevant values as instructed. This step is only required if you chose not to use an existing Entra ID integration above.
      • After creating the app registration, enter the application (client) ID and the client secret.
   6. Under Capabilities, select the capabilities to enable. Your selection determines the required permissions and dynamically updates the deployment script. Tenable recommends enabling all capabilities to provide the most comprehensive security coverage. For more information, see Azure Permissions.
   7. Under Deployment, select one of the following deployment options:
      • PowerShell. Script-based deployment. Copy the script that appears in the wizard and run it in Azure CLI or Azure Cloud Shell to grant AI Exposure the required permissions.
        • To assign roles, you must have the Microsoft.Authorization/roleAssignments/* permission on the root management group scope in Azure. This permission is granted by the Owner or User Access Administrator roles. For step-by-step guidance on resolving Azure role and permission errors, see Resolve Cloud Onboarding Permission and Role Errors (AWS, Azure, GCP).
        • If you don't have this permission/role, but you have the Global Administrator role in Microsoft Entra ID, you can temporarily elevate your access to gain management permissions over all Azure subscriptions and management groups.
      • Manual. Manually, via the Azure portal. See Manually Deploy an Azure Organization for step-by-step instructions on creating custom roles and assigning permissions.

   8. Under Post Deployment, enter the primary domain name and the service principal ID.

      Note: How to retrieve values - PowerShell: Copy/paste the values from the script output. - Manual: See Manually Deploy an Azure Organization for how to retrieve these values. Shared integration values - These values must be identical across the organization and all its member subscriptions. - When an organization is connected, these fields can only be updated at the organization level. Changes will automatically propagate to all member subscriptions.
   9. When finished, click Next.

4. In the Scopes step (step 2 of 2):

   1. (Optional) Select Automatically update compartments structure to mirror your compartment's structure as folders within Tenable, preserving the hierarchy and keeping the view synchronized. For more information, see Account Hierarchy and Folders.
   2. Under Scopes, choose which compartments to onboard:
      • Sync all current and future subscriptions (recommended)
      • Include specific groups and subscriptions

      • Exclude specific groups and subscriptions

        Note: If you include/exclude an entire folder, all current and future projects within the group are included/excluded. If you include/exclude specific projects in a folder, only the selected projects will be included/excluded.
   Note: During onboarding, AI Exposure detects every subscription in the organization, including canceled and deleted subscriptions. AI Exposure automatically filters out canceled and deleted subscriptions and does not onboard them. As a result, the number of detected subscriptions can be higher than the number that appear on the Accounts page.
5. Click Finish.

Manually Deploy an Azure Organization

Manually deploy your Azure organization via the Azure portal. This procedure is relevant if you selected Manual for the Deployment type when connecting your Azure organization.

1. Log in to the Azure portal for the organization that you want to connect.
2. (Only relevant if you chose Do not use Microsoft Entra ID integration above when you connected the organization.) Perform the following:
   • Obtain the Service Principal ID:
     1. Run the following command using the Azure CLI or Azure Shell: az ad sp create --id 2608e51d-866a-43c9-99ab-3e44347ccb38 --query id
     2. Copy and save the Service Principal ID. You will need to enter this value in the AI Exposure Console when connecting your organization.
   • Obtain the Primary Domain Name.
     1. Navigate to Microsoft Entra ID.
     2. Navigate to Overview > Basic information and locate the Primary domain. Copy and save the value. You will need to enter this value in the AI Exposure Console when connecting your organization.
3. Navigate to the Access control (IAM) tab within the root management group
4. Create a custom role called Tenable Data Scanning and add the following permissions to it:
   • Microsoft.Storage/storageAccounts/privateEndpointConnections/write
   • Microsoft.Sql/servers/databases/write
5. Assign roles to the AI Exposure Connector app by repeating the steps below for all roles related to the capabilities you want to use.
   1. Click on Add > Add role assignment.
   2. Search for and select a role from the list and click Next.
   3. Click + Select members.
   4. Search for and select AI Exposure Connector and then click Select.
   5. Click Next and then click Review + assign to finish. Repeat these steps for all additional roles.
6. Navigate to the AI Exposure console and enter the following values in step 1 of the wizard:
   • Primary Domain Name
   • Service Principal ID
7. Click Next and continue with step 2 of the wizard.

Next Steps

After your Azure organization is connected, subscriptions that belong to the organization appear on the Accounts page, under the Azure folder. From here, you can manage subscriptions and view connection status and enabled features.

The time required for Azure resource data to appear in AI Exposure varies based on the size and complexity of your environment.

To enable identity-related visibility, permissions analysis, and Just-in-Time access insights, configure a Microsoft Entra ID connection, if you didn't already.