Connect an Azure Subscription

Use this procedure to connect an individual subscription. Alternatively, you can connect your entire organization. Follow the wizard to choose which features to enable, and then add role assignments in Azure to grant the Tenable One AI Exposure application access to the subscriptions.

Prerequisites

Before you begin:

• Ensure you can access the Azure subscription you want to connect.
• Ensure you have permissions to create or use an application identity in Microsoft Entra ID for authentication to Azure APIs.
• (Public environments only) To verify tenant access, ensure you are either a member of the tenant organization or a guest user with the Global Administrator role. You can only be a guest user if you have integrated Microsoft Entra ID with the AI Exposure Console.

Connect a Subscription

To connect an Azure subscription:

1. In the AI Exposure Console, navigate to Settings > Integrations and click + Add Integration.
2. In the Integrations Library, select Azure Subscription. The Azure Subscription wizard opens.
3. In the wizard:
   1. Enter the relevant subscription ID. You can find it in the Azure portal under Subscriptions.
   2. Select the relevant Azure Cloud environment: Public or China.
      • Public — The deployment script creates a service principal in your tenant tied to Tenable's multi-tenant app, which is used to pull data via the Microsoft Graph API.
      • China — You will need to manually create a dedicated app registration in Microsoft Entra ID, as instructed in the Application section of this wizard. The deployment script creates a service principal tied to the app registration, which is used to pull data via the Microsoft Graph API.
   3. Under Microsoft Entra ID, select whether to use an existing Entra ID integration. If an integration does not exist, you can click + Create.
      • If selecting not Do not use Microsoft Entra ID integration, enter the tenant ID associated with the relevant Azure subscription to allow Tenable to identify the organization with the subscription.
   4. Under Access Verification, click Verify. You are redirected to sign in to your Microsoft Entra ID tenant. This step ensures that the user creating the integration is a member of a target tenant or a guest user with the Global Administrator role, and is only required for public environments.
   5. (Chinese environments only) Under Application, create a dedicated app registration in Microsoft Entra ID by following these instructions, making sure to copy and save the relevant values as instructed. This step is only required if you chose not to use an existing Entra ID integration above.
      • After creating the app registration, enter the application (client) ID and the client secret.
   6. Under Capabilities, select the capabilities to enable. Your selection determines the required permissions and dynamically updates the deployment script. Tenable recommends enabling all capabilities to provide the most comprehensive security coverage. For more information, see Azure Permissions.
   7. Under Deployment, select one of the following deployment options:
      • PowerShell. Script-based deployment. Copy the script that appears in the wizard and run it in Azure CLI or Azure Cloud Shell to grant AI Exposure the required permissions.
        • To assign roles, you must have the Microsoft.Authorization/roleAssignments/* permission on the root management group scope in Azure. This permission is granted by the Owner or User Access Administrator roles.
        • If you don't have this permission/role, but you have the Global Administrator role in Microsoft Entra ID, you can temporarily elevate your access to gain management permissions over all Azure subscriptions and management groups.
      • Manual. Manually, via the Azure portal. See Manually Deploy an Azure Subscription for step-by-step instructions on creating custom roles and assigning permissions.

   8. Under Post Deployment, enter the primary domain name and the service principal ID.

      How to retrieve values - PowerShell: Copy/paste the values from the script output. - Manual: See Manually Deploy an Azure Subscription for how to retrieve these values. Shared integration values - These values must be identical across the organization and all its member subscriptions. - You must have permissions in AI Exposure to update all related subscription integrations to change these values, ensuring they remain identical across your environment. - When an organization is connected, these fields can only be updated at the organization level. Changes will automatically propagate to all member subscriptions.

   9. When completed, click Finish.

Manually Deploy an Azure Subscription

Manually deploy your Azure organization via the Azure portal. This procedure is relevant if you selected Manual for the Deployment type when connecting your Azure subscription.

1. Log in to the Azure portal for the subscription that you want to connect.
2. (Only relevant if you chose Do not use Microsoft Entra ID integration above when you connected the organization.) Perform the following:
   • Obtain the Service Principal ID:
     1. Run the following command using the Azure CLI or Azure Shell: az ad sp create --id 2608e51d-866a-43c9-99ab-3e44347ccb38 --query id
     2. Copy and save the Service Principal ID. You will need to enter this value in the AI Exposure Console when connecting your Azure subscription.
   • Obtain the Primary Domain Name.
     1. Navigate to Microsoft Entra ID.
     2. Navigate to Overview > Basic information and locate the Primary domain. Copy and save the value. You will need to enter this value in the AI Exposure Console when connecting your Azure subscription.
3. Create a custom role called Tenable Data Scanning and add the following permissions to it:
   • Microsoft.Storage/storageAccounts/privateEndpointConnections/write
   • Microsoft.Sql/servers/databases/write
4. Assign roles to the AI Exposure Connector app by repeating the steps below for all roles related to the capabilities you want to use.
   1. Navigate to Access Control (IAM) and click on Add > Add role assignment.

   2. Search for and select a role from the list in the wizard and click Next.

      Note: Access Administrator* (for JIT) role is in the Privileged administrator roles tab. The User Access Administrator (for JIT) role is in the Privileged administrator roles tab.
   3. Click + Select members.able AI Exposure Connector** and then click Select.
   4. Search for and select AI Exposure Connector and then click Select.ll additional roles.
   5. Click Next and then click Review + assign to finish. Repeat these steps for all additional roles.
5. Navigate to the AI Exposure console and complete the Post Deployment section of the onboarding wizard.

Next Steps

• Azure resource data begins to appear in AI Exposure. The time required varies based on the size and complexity of your environment.
• You can update enabled features and application details later, subject to the following rules:
  • If the subscription is connected as part of an Azure organization, updates must be made at the organization level.
  • If only subscriptions are connected, updates apply to all related subscriptions and require permission to update all of them.
• If you connected Azure without Microsoft Entra ID, identity-related insights (such as permissions analysis and Just-in-Time access) are not available until Microsoft Entra ID is connected. To enable identity-related visibility, permissions analysis, and Just-in-Time access insights, configure a Microsoft Entra ID connection.