Microsoft Azure

Connect Microsoft Azure to Jutsu. Jutsu signs in to Azure as an app you register, lists the subscriptions that app can see, checks on each one whether it holds the Reader and Security Reader roles, and shows you the health of the connection and exactly which role is missing where. The connection is read-only: it can never change anything in Azure.

This is the first step of the Azure integration. Read What this connection does today below before you set it up, so you know what to expect.

Jutsu connects with a client secret. You register an app in Azure, give it two read-only roles on each subscription, make a secret for it, and paste three values into Jutsu. Jutsu stores the secret encrypted and uses it only to read.

What this connection does today#

Once connected, Jutsu:

• Signs in to Azure with the app's client secret.
• Lists the subscriptions the app can see.
• Checks on each subscription whether the app holds Reader and Security Reader.
• Shows whether the connection is healthy and, for every subscription, which role is missing. Check again reads Azure again. There is no scheduled check yet, so select it after any change in Azure.
• Lets you choose which subscriptions to read, and replace the secret before it expires.

It does not do these yet:

• Check your Azure settings against your compliance tasks.
• Import Microsoft Defender for Cloud findings.
• Collect Azure activity logs.
• Connect without a secret. The Without a secret option appears in the dialog but is switched off, and says Not available in this environment yet.

The connection page shows these as "coming soon" and reports only whether the role each one will need is in place. Entra ID sign-in and audit logs don't come from this connection. They come from the separate Microsoft 365 integration.

The two roles#

Jutsu asks for two built-in Azure roles, and only on the subscriptions you choose, never on your whole directory.

Without Reader, Jutsu can't read a subscription at all. Without Security Reader, Jutsu can still read the subscription, and only the Defender for Cloud import will need it later.

Set up Azure#

There are two ways to do the Azure side. Pick one.

• The Azure portal, click by click. Best if you want to see each setting.
• Azure Cloud Shell, one pasted script. Best if you'd rather copy than click.

Both end with the same three values. You can also start the Jutsu dialog first (Part 2 below), because it shows the same instructions and the same script. Keep it open in one tab and use Azure in another.

Option A - The Azure portal#

Step 1 - Register an app#

Sign in to the Azure portal and open Microsoft Entra ID, then App registrations, then New registration.

• Name: anything recognisable, such as Jutsu read-only.
• Supported account types: choose Single tenant (Accounts in this organizational directory only).
• Leave Redirect URI empty.

Select Register.

Step 2 - Copy the two IDs#

The app's Overview page opens. Copy these two values and keep them for Step 6:

• Directory (tenant) ID
• Application (client) ID

Step 3 - Make a client secret#

On the app, open Certificates & secrets, then Client secrets, then New client secret. Give it a description such as Jutsu, choose how long it lasts, and select Add.

Azure now shows the secret with two columns, Value and Secret ID. Copy the Value, not the Secret ID.

Step 4 - Give the app Reader on a subscription#

Open Subscriptions in the portal and select the subscription you want Jutsu to read. Open Access control (IAM), select Add, then Add role assignment.

1. On the Role tab, search for Reader, select it, and select Next.
2. On the Members tab, leave Assign access to on User, group, or service principal, select Select members, search for the app by the name you gave it, select it, and select Select.
3. Select Review + assign, then Review + assign again.

Step 5 - Give it Security Reader on the same subscription#

Repeat Step 4 on the same subscription, this time choosing Security Reader as the role.

Do Steps 4 and 5 for each subscription you want Jutsu to read. You can add more subscriptions later, from Jutsu's connection page.

Option B - Azure Cloud Shell#

The script makes the app, makes a secret, gives the app Reader on one subscription, adds Security Reader on the same subscription, and prints the three values to paste into Jutsu. It runs on your default subscription. To use another one, run az account set --subscription "<name>" first.

Step 1 - Open Cloud Shell#

Open shell.azure.com and sign in. If Azure asks which shell to use, pick Bash.

Step 2 - Paste the script#

Paste this into the Cloud Shell terminal and press Enter. It is the same script the Jutsu dialog shows under Rather use the command line?

# Runs on your default subscription. For another one, first run: az account set --subscription "<name>"
SUB=$(az account show --query id -o tsv)

# Make the app and a secret, with Reader on the subscription
OUT=$(az ad sp create-for-rbac --name "Jutsu read-only" --years 1 --role "Reader" --scopes "/subscriptions/$SUB" -o json)
APP=$(echo "$OUT" | jq -r .appId)

# Add Security Reader on the same subscription
az role assignment create --assignee "$APP" --role "Security Reader" --scope "/subscriptions/$SUB"

# The three values to paste into Jutsu
echo "$OUT" | jq '{tenantId: .tenant, clientId: .appId, clientSecret: .password}'

Step 3 - Copy the three values#

The last command prints a small block of JSON:

• tenantId is the Directory (tenant) ID.
• clientId is the Application (client) ID.
• clientSecret is the secret's Value.

Copy all three. The secret is shown here once and it lasts one year (--years 1), so note the date.

Connect it in Jutsu#

Step 1 - Open Integrations#

Go to app.jutsu.ai and select Integrations in the left navigation. It sits under More. The Data Sources tab opens by default.

Step 2 - Select the Microsoft Azure card#

In the Cloud section, select the Microsoft Azure card. The Connect Microsoft Azure dialog opens, with five steps across the top: How, Azure, Details, Subscriptions, Done.

Step 3 - How#

Keep With a secret (Quickest. Paste a secret from Azure.). Without a secret is greyed out. Select Continue.

Step 4 - Azure#

Choose how to set up Azure:

• Azure Cloud Shell (recommended). Three steps: Open Cloud Shell, paste the script (it has a Copy button), and copy the three values it prints. The dialog shows which printed value goes in which field: tenantId in Directory (tenant) ID, clientId in Application (client) ID, clientSecret in Secret value. This is Option B above.
• Azure portal. Three steps, each with a button that opens the right Azure page: Register an app, Add a client secret, and Give it two roles on each subscription, with Reader and Security Reader ready to copy. This is Option A above.

Exactly what the two roles allow opens the role table above, with each role's ID.

If you haven't done the Azure side yet, do it now. Then select Continue.

Step 5 - Details#

Fill in the form:

• Name: something that identifies the connection, such as Acme Azure Production.
• Directory (tenant) ID: from the app's Overview page.
• Application (client) ID: from the app's Overview page.
• Secret value: the secret's Value, not the Secret ID. Jutsu stores it encrypted and uses it only to read.

Select Test connection. Jutsu asks Azure which subscriptions the app can see. Nothing is stored yet.

If the form says That is not the right shape. Copy it straight from the Overview page., an ID has a typo or an extra character. If it says This looks like the Secret ID. Paste the Value beside it., go back to Azure and copy the Value column instead.

Step 6 - Subscriptions#

Jutsu shows Azure showed N subscriptions and lists every one the app can see, each with a status:

Only a subscription Jutsu can read can be ticked, so a missing Reader or a turned-off subscription blocks the tick. A missing Security Reader doesn't, because Jutsu can still read the settings.

A subscription that isn't ready has a How to give it the role section with the exact az role assignment create command, and an access page link that opens the subscription's Access control (IAM) in Azure. Add the role, come back, and select Check again. Jutsu reads Azure again and ticks the subscriptions that became ready.

Tick the subscriptions Jutsu should read, then select Connect. The button counts them, such as Connect 3 subscriptions. You can choose up to 200.

Step 7 - Done#

The dialog says Connected. and offers Open connection. Jutsu checks the chosen subscriptions as part of connecting, so the connection page shows the result straight away. After that it checks only when you select Check again.

Find the connection#

Jutsu adds the connection to Connections, under Cloud. If the first check could not finish while you connected, the page says Jutsu is checking Azure for the first time. This takes a few minutes. and its status shows Checking. Select Check again to finish it.

Verify the connection#

Open the connection. Its Overview tab starts with one sentence and the time of the last check.

• Azure is working. Jutsu can read all N subscriptions. Everything is in place.
• Azure is working, but the Security Reader role is missing on N subscriptions. Jutsu reads them. Add the role when you want the Defender import to be ready for them.
• Jutsu cannot read N of M subscriptions. A Reader role is missing, or a subscription is turned off. The Subscriptions list says which.

The status at the top of the page is Working, Needs attention, Cannot sign in, or Checking. Select Check again after any change in Azure.

Under Subscriptions, each row shows Working, or what is wrong (Needs Reader, Needs Security Reader, Needs both roles, Turned off in Azure), with the command that fixes it. A row can also say Not checked yet, or Azure error if Azure didn't let Jutsu read it just then, which Check again retries.

What Jutsu does here has two rows. Neither runs yet. Each shows only whether the role it will need is in place:

Open Configure → Settings for the technical facts: How Jutsu signs in, Subscriptions chosen, the Directory (tenant) ID, the Application (client) ID, and Secret, which reads Stored encrypted since the date you connected. Jutsu never shows the secret again.

What healthy looks like#

Change what Jutsu reads#

Choose subscriptions#

On the connection, select Choose subscriptions (on the Overview tab, or under Configure → Settings). Jutsu reads Azure for the current list, and you tick or untick subscriptions. Jutsu reads the ticked ones when it checks access. Unticking one stops that. Select Save.

This is also how you add a subscription later. Give the app Reader and Security Reader on it in Azure, then tick it here.

Replace the secret#

Replace the secret before it expires, or when it was pasted wrong. In Azure, open the app, then Certificates & secrets, then New client secret, and copy the Value. In Jutsu, open Configure → Settings and select Replace secret, paste it into Secret value, and select Replace secret. Jutsu tries the new secret before it replaces the old one, so a wrong paste leaves the working secret in place.

Replacing the secret, choosing subscriptions, and Check again all need the Owner or Admin role. Others see the connection and are told to ask an admin.

Troubleshooting#

Security and access#

• Jutsu only reads. Reader and Security Reader can't change a resource, a policy, or a finding, and can't read what is stored inside your storage, databases, or secret stores.
• The roles are on the subscriptions you choose, not on your directory. Remove them from a subscription and Jutsu loses access to it at once.
• The secret is encrypted at rest and is sent to Jutsu once, when you connect or replace it. It is never shown again.
• Use a dedicated app for Jutsu, as in the steps above, so you can revoke it without touching anything else.
• Secrets expire. Put the expiry date in your calendar and replace the secret before then.

Remove the connection#

Removing it takes two parts: archive or delete the connection in Jutsu, then remove Jutsu's access in Azure. Archiving doesn't touch your Azure account.

1. In Jutsu, open the connection and go to the Danger zone. Archive stops the checks and can be undone. Delete removes the connection for good.
2. In Azure, remove the app's access. Delete the app's secret, or delete the app under App registrations. If you want to keep the app, remove its Reader and Security Reader assignments under each subscription's Access control (IAM).