Manual Azure Onboarding Fail

DSarnelli — Fri, 29 Sep 2023 12:31:37 GMT

HI,
after carrying out all the steps reported in the official guide, Azure onboarding fails.
Part of the error is as follows:
Prisma Cloud application is not assigned following action(s): ["Microsoft.Logic/integrationAccounts/read", "Microsoft.Insights/actionGroups/read", "Microsoft.Network/networkSecurityGroups/read", "Microsoft.RecoveryServices/Vaults/ read", "Microsoft.Sql/servers/administrators/read", "Microsoft.Network/networkSecurityGroups/securityRules/read", "Microsoft.Authorization/classicAdministrators/read", "Microsoft.Network/networkWatchers/securityGroupView/action", " Microsoft.Quantum/Workspaces/Read", "Microsoft.StorageSync/storageSyncServices/privateLinkResources/read", "Microsoft.Sql/servers/databases/transparentDataEncryption/read"

If I use the terraform script instead, everything works correctly.
In the manual procedure I also tried to use the custom role, which creates the terraform script where there are all the permissions inside (including those above)

What can I do to understand the problem on Azure?

Thank you
Dario

Re: Manual Azure Onboarding Fail

BCastillo — Mon, 09 Oct 2023 18:52:32 GMT

Hello DSarnelli,

Thank you for your question.

Prisma Cloud allows you to add an Azure permissions Manually or via Terraform Script.

One thing to keep in mind, if you do add permissions manually, please note that if the Cloud account onboarded is a Subscription. You would need to add the permission at the Subscription level (IAM).

If you onboarded a Azure Tenant, the permissions would need to be added ad the Tenant Root Group (IAM). So even if the Prisma App contains the permissions at the Subscription level. You will still see missing permission as these permissions need to bee added at the Tenant Root Group.

Hope this helps.

Regards,

topic Manual Azure Onboarding Fail in Prisma Cloud Discussions

Manual Azure Onboarding Fail

Re: Manual Azure Onboarding Fail